Nessus HSTS check and redirects HTTP 3xx codes

 https://community.tenable.com/s/article/Verify-strict-transport-security-header-for-HSTS-Missing-From-HTTPS-Server?language=en_US

curl -sSI http://domain.com/

Palo alto and azure SAML auth

KBs:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g0000008U48CAE

https://learn.microsoft.com/en-us/entra/identity/saas-apps/palo-alto-networks-globalprotect-tutorial

Generate the the cert and make it active

Delete the old cert

Wait a few minutes for azure cloud to update 

Download the xml

delete old certs from palo

Import the xml into palo this will create cert and SAML IDP profile

Don't tick validate check box

Select the new IDP profile in your azure auth profile

NAT rules on palo alto

 Making a note because its a bit different to cisco ASA

NAT rule

OUTSIDE > OUTSIDE 

Public src > Public dst

FW rule 

OUTSIDE > INSIDE (counted as inside because of the NAT)

Public src > Public dst

show ports listening on cisco router

show tcp brief all

show control-plane host open-ports

dynamic split tunnel FTD

 https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client-v4x/220247-configure-anyconnect-dynamic-split-tunne.html

gre tunnels not coming up

Have an issues but not sure of the cause, sometimes the GRE tunnel does not re-establish over a S2S VPN.

Save backup config and check routes

Ensure your S2S VPN config is correct, usually you will see VPN p1 up but GRE tunnel showing as up/down.

shut down both tunnel interfaces on either end

save the router config

reboot the remote router config

bring up tunnel interface in HQ router

Now bring it up on the remote router

Ensure all routes are in place

remote > HQ (tunnelxx)

HQ > remote (tunnelxx)

FMC 7.4 notes

Create a blank policy called onboarding with nothing attached 

This is if you are moving FTD's between FMC there is some unique things like NAT and interface zones so best to

Make sure to backup your policy

ASA side IP / routing conifg

delete the manager

wipe FTD

add to new manager (onboarding policy)

Once added switch to your new real policy