I couldn't make changes. It said my user had the lock but still couldn't make the changes.
Check you are not on the passive firewall.
Clicked the padlock in top right that had a (3) beside it. I could clicked on all users and clicked "remove lock"
Others reported having to use the CLI
show commit-locks
request commit-lock remove
To configure Virtual appliance (VA), enter configuration mode (CTRL+B)
config va name umbrella01 (this name is just a label)
config va interface 172.16.0.6 255.255.255.0 172.16.0.1
config localdns add 172.16.0.8 (DC1)
config localdns add 172.16.0.9 (DC2)
https://docs.umbrella.com/deployment-umbrella/docs/appendix-d-troubleshooting-the-va-using-a-restricted-shell#section-use-configuration-mode-to-troubleshoot
Config auto updates
Need 2 VAs'
FW access to the URLS in setup doc
Config Deployments > Configuration > Sites and Active Directory.
Settings button top right
Auto upgrade
Palo Migrations tool kept failing without an explanation
The tool seems to have an issue with psks on the VPNs
When you load the config from the migration you need to change / update the psks and it will load correctly
Get the customer to give you MS account global admin on their tenant
Nessus doc's don't quite match up to MS interface as MS interface is changing all the time:
https://docs.tenable.com/integrations/Microsoft/Azure/Content/ConfigureAzureComplianceAudit.htm?Highlight=microsoft%20365
Log into portal.azure.com (azure.microsoft.com)
Setup on OTP portal and update boost
Log into the customer tenant
Copy tenant ID from Home -> MS entra ID > overview into a notepad
Click on active directory (entra ID triangle icon)
Manage > App registrations on the left
Click the + New App registration button
Client credentials -> Add a certificate or secret
+ New client secret
Give name
Set expire
Copy value and secret ID *** IMPORTANT it will disappear and you will have to start again
ID looks like 7777701d-xxxx-yyyy-zzzz-6b6a1c969999 (don't think you need this but record anyway)
secret value is the secret key which we will need later (record everything so you have it)
Get the app ID from the app registrations and search Nessus
put them in a safe notepad with tenant ID (will need later)
To find the app reg again
Click app registrations, all applications and search your app reg name "Nessus"
Home -> Entra ID -> customer -> Roles and admins -> all roles ->
Search Global Reader *** wasn't there for some license levels***
Right click and go to description page (or 3 dots on end)
Go to Assignments on the left
+ Add assignments
Add to NessusScan app reg
Create new app
Get app ids + keys
Create a new client secret
You need to save the secret when it appears as it only displays once
Microsoft Graph *** old ***
Home -> Microsoft Entra ID > App Registrations > Your Application > API Permissions
Permissions -> applications -> read all (reader role)
Expand all and tick Read.All
In Nessus scan app > API Permissions
Add permission > Microsoft Graph > Application permissions
select all read ones
click add permissions
Then grand admin consent
Scanning Microsoft Intune:
CTF
pico ctf
tryhackme
hack the box
on the wire
ine - elearn cppt (watch videos no need to take cert)
oscp - PEN200 OSCP (cert to chase)
policy-map type network-qos jumbo
class type network-qos class-default
mtu 9216
exit
exit
system qos
service-policy type network-qos jumbo
wr
Didn't need a reboot maybe a blip in connectivity
This is down to how cisco/webex resolves DNS. Depending on config it can be looking for external DNS records which need to resolve.
We already had an internal AD domain added (customer.com) in the umbrella dashboard as part of the internal domains.
On a working cap we saw it look for
_collab-edge._tls.customer-ext.com which didn't resolve
Then it looked for
_cisco-uds._tcp.customer-ext.com
which did resolve to the customer ucm server IP's (this must have been resolve by internal DC/DNS)
On the "not working" capture
Wireshark showed a SRV record
_cisco-uds._tcp.customer-ext.com was attempting to get resolved by the client but getting a "No such name" back from a public DNS server. It tried to resolve on the internet.
We needed to go into the DC and edit DNS on the external domain customer-ext.com
We also added the customer-ext.com to the internal domains in the umbrella dashboard.
Find DNS queries that didn't return an answer
