Extracting TRAFFIC, THREAT, CONFIG and SYSTEM syslog from a Palo Alto Networks Next Generation Firewall with Graylog

Graylog is a brilliant (and Open Source) tool to easily capture logs from a variety of systems including good old fashioned syslog. In the screenshot guide below you will learn how to use a set of extractors I constructed to parse out useful information from PAN NGFW syslog. The link to the source files mentioned is: https://github.com/jamesfed/PANOSGraylogExtractor

Backing up a Palo Alto Networks Next Generation Firewall with PowerShell

For some time there have been plenty of examples of backing up Palo Alto Firewalls with curl commands (extracting the files using the XML API) however that may not sit well with some Windows administrators who want to use PowerShell. As such I’ve put together the BackupPANNGFWConfig repo on GitHub which contains the scripts to get ahold of the API… Read more

From around the web, Saturday 3rd August 2019

For this weeks ‘from around the web’ we are looking at some very cool screens that I’ve just started working with for an Arduino project, some advice from the National Cyber Security Centre and a brilliant set of resources to build a plan to secure an IT environment. Nextion displays for Raspberry Pi/Arduino For a little while now I’ve been… Read more

From around the web, Sunday 21st July 2019

A late one for this release of ‘from around the web’ after being on holiday for the last week – as the case always seems to be I’ve come out of the sun quite red. This week we have another step in the right direction to getting rid of passwords, some helpful templates for building a first config for a… Read more

From around the web, Tuesday 9th July 2019

In this new blog post series I’ll be looking at (normally a selection of 3) cool articles, news and other blog posts that I find interesting during the day. For this week we have PowerShell tricks, a detailed article on securing the Windows Firewall and an (old but very interesting) write up on the woes of network administrators when everything… Read more

Server 2019 Network Policy Server (NPS) doesn’t reply to RADIUS requests

Bit of a crazy issue when deploying a new Ruckus wireless network – in first suspecting an issue with the controller software or perhaps some kind of access control list blocking traffic it turns out that the default Windows Firewall rule for allowing NPS traffic is broken in some fashion. Having tried this (and it working fine) on Windows Server… Read more

The BUBM Cable Bag (and what I keep in it)

A bit of an odd post but given this bag is proving so very handy I thought it worth it! Having started a new job at the beginning of the year it was evident that I would need to carry around a bit more kit with me than previously, with Christmas just around the corner it was the perfect time… Read more

HPE ProCurve/Aruba turn off — MORE — (aka paging)

When running CLI commands against an HPE Aruba (previously ProCurve) switch that have long outputs you have likely encountered the line below. — MORE –, next page: Space, next line: Enter, quit: Control-C Although handy – on occasion you might need to turn this off. To do so simply run the command (no need to be in config mode for… Read more

Ruckus SmartZone – check that an Access Point has received the latest configuration

While iterating through an issue with our Ruckus SmartZone (with Ruckus R510 Access Points) controllers I was looking for a way to see when the Access Points had applied the new configuration; lone behold it’s quite easily done through both the CLI and the GUI. Anyone who has used the new SmartZone controllers will know all too well that’s it’s… Read more