test authentication profile palo alto cli

 test authentication authentication-profile "AD Kerberos" username USERMAME password

script to gather network information on windows

.bat script to gather network information on windows, you can add or remove things as needed

Set > %userprofile%\downloads\_Set.txt

echo %logonserver% > %userprofile%\downloads\_logonserver.txt

whoami  > %userprofile%\downloads\_whoami.txt

hostname  > %userprofile%\downloads\.txt

ipconfig /all  > %userprofile%\downloads\_ipconfig_all.txt

ipconfig /displaydns > %userprofile%\downloads\_displaydns_post.txt

route print  > %userprofile%\downloads\_routeprint.txt

tracert -d 192.168.2.100  > %userprofile%\downloads\_tracert_2_100.txt

ping 192.168.2.100  > %userprofile%\downloads\_ping_2_100.txt

nslookup cust.url.com > %userprofile%\downloads\_nslookup.txt

wmic NIC where NetEnabled=true get Name,Speed  > %userprofile%\downloads\_NICSpeed.txt

gpresult /V >> %userprofile%\downloads\_gpresult.txt

can't ping SVI interface on remote switch across S2S VPN

 Had an issue could ping vlan1 (LAN) SVI but not vlan146 (VOICE)

The setup was

LAN client -> L2 VL1 -> L3 SVL VL1 -> Inside ASA -> S2S VPN -> HQ 

Phone client -> L2 VL146 -> L3SVI VL146 -> L3 SVI 1 -> Inside ASA-> S2S VPN -> HQ -> Phone server

I found some messed up NAT's

Removed the global

object network obj_any

 nat (any,outside) dynamic interface

The NoNat had a missing object in the destination

nat (voice,outside) source static obj-10.60.146.0 obj-10.60.146.0 destination static HQ-NET HQ-NETS no-proxy-arp route-lookup

Also needed this NAT on the INSIDE with the 146 networks to ping the SVI. This is becuase the route to the HQ network is through the inside interface of the ASA.

nat (inside,outside) source static obj-10.60.146.0 obj-10.60.146.0 destination static HQ-NET HQ-NETS no-proxy-arp route-lookup

Find the source of DNS request on windows client

 To tracks the DNS request back to a PC you can use cisco umbrella or watching the DNS debug logs on the DNS server. That will tell you the IP of the machine the DNS requests are coming from but you may want to know what process its coming from.

There are a few tools you can use

Microsoft Sysmon (sysinternals)

1 - Download sysmon

https://technet.microsoft.com/en-us/sysinternals/sysmon

2 - Download swift security profile

https://github.com/SwiftOnSecurity/sysmon-config

3 - Install sysmon with the swift security profile

Sysmon.exe -accepteula -i .\sysmonconfig-export.xml

4 - Open event viewer and check the sysmon logs

Eventvwr.msc

Applications and services logs -> Microsoft -> Windows -> Sysmon

Right click -> find  search for URL

You will see the process under image name.

Wireshark

Won't show you the process it came from but you should see when requests are happening

Useful capture filters

Show all dns traffic:

dns

Show DNS requests to the URL and also any connections to its IP, URL = x1.c.lencr.org, nslooked up to 23.72.154.199

(ip.dst == 23.72.154.199) or ((dns.qry.name == x1.c.lencr.org))

Look for all DNS requests coming from my PC 192.168.1.10

(dns.flags.response == 0) and (ip.src == 192.168.1.10) and (dns.qry.name == x1.c.lencr.org)

tcpview

Someuser report success using TCP view. Nslookup the URL -> IP then watch TCPview for connections to that IP. Usually a connection to the IP will happen straight after a DNS request

Uncheck TCPv6 etc if this is not your traffic. A good place to start is IPv4 only and then search for the IP, we should see a module/process

Windows transfer speed slow in one direction over VPN

Copy files A -> B was fine

but B-> A was slow

Checked all the devices, VPN all looking good. It sended up being a simple duplex issue. The link from the switch to the firewall on side B was auto'd to half-100. I hard coded it to 1000 full and all was good.

Steps to follow

Check the full network path from side A<->B is speed/duplex correct on switchports.

RAM+CPU good on each device that is moving the data

Run speed test to make sure internet connetions are ok

Run some ping -t to watchout for packet loss

smokeping or pingplotter several places local, across vpn, internet (1.1.1.1,8.8.8.8,4.2.2.2) for packet loss + latency

Check if Server is VM and check vmware for datastore for any issues

Check for arp issues, is there arp poisoning or static arp entry somewhere, is the mac address hopping around for one of the source/destination IP

Quickly generate dummy files for testing file copies on windows

 https://tweaks.com/windows/62755/quickly-generate-large-test-files-in-windows/

fsutil file createnew 1gb.test 1073741824

The key is to input the size of the file in bytes so here are some common file sizes to save you from math:

1 MB = 1048576 bytes

100 MB = 104857600 bytes

1 GB = 1073741824 bytes

10 GB = 10737418240 bytes

100 GB =107374182400 bytes

1 TB = 1099511627776 bytes

10 TB =10995116277760 bytes

test policy on palo alto similar to packet tracer

 I haven't had much luck with this, it doesn't seem to work as well as packet tracer. It's often returning that the traffic is blocked when in fact it is allowed.

Anyway you can give it a go, its down the bottom in the GUI "Test policy match"

On CLI:

test security-policy-match source 192.168.0.1 destination 8.8.8.8 destination-port 53 protocol 17

test security-policy-match source 192.168.0.1 destination 8.8.8.8 destination-port 443 protocol 6

Protocol 17 = udp

Protocol 6 = tcp

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-cli-quick-start/use-the-cli/test-the-configuration/test-policy-matches