Jump to content

Recommended Posts

Posted

Thanks alot for sharing this.

This works perfectly and for now I have used basic firewall policies and NAT Rules and not gone through NGFW features yet

I am using below qemu options:

-machine type=pc,accel=kvm -nographic -rtc base=2021-09-12,clock=vm
I have given 6Gigs of RAM so that these devices boot up a bit faster.

However I see some issues in terms of logs:

1. The logs I can see are only from inside to outside interfaces.

2.I don't see any logs between lets say DMZ to outside or DMZ to inside as an example.

3. I override intra-zone-default to log at both session start and end but it still don't generate logs neither I see hits if their is any issue in rules.

4. I created an explicit DENY_ALL rule to overcome issue with point 3 above, I can see hits on that rule but again don't see any logs in monitor tab.

 

Can someone let me know how to figure out these log issues:

 

rule_1.png

Posted

update:

I tested below till now and found not working:

1. USER ID doesnt work. I was able to connect to AD and can even see user groups but in show user ip-user-mapping all it shows nothing no matter what I tried. In the end I exported the config to an unlicensed Palo Alto 10.1 and it all started working.

 

  • 3 weeks later...
Posted
On 10/3/2021 at 4:09 AM, netkillui said:

 

Hidden Content

  • Give reaction or reply to this topic to see the hidden content.

 

 

 

Hidden Content

  • Give reaction or reply to this topic to see the hidden content.

 

 

Hidden Content

  • Give reaction or reply to this topic to see the hidden content.

 


In case qemu vm shuts down after changing password, add '-rtc base=2021-09-12' in eve-ng node options to boot with valid time period. 

 

 

ty

  • Like 5
  • Thanks 1
  • 2 weeks later...
  • 2 weeks later...
  • 2 weeks later...
  • 4 weeks later...
Posted
On 10/3/2021 at 4:09 AM, netkillui said:

 

Hidden Content

  • Give reaction or reply to this topic to see the hidden content.

 

 

 

Hidden Content

  • Give reaction or reply to this topic to see the hidden content.

 

 

Hidden Content

  • Give reaction or reply to this topic to see the hidden content.

 


In case qemu vm shuts down after changing password, add '-rtc base=2021-09-12' in eve-ng node options to boot with valid time period. 

 

 

amazing

 

  • Like 5
  • Thanks 3
  • 1 month later...
  • 3 weeks later...
  • 3 weeks later...
  • 2 weeks later...

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...