Palo Alto

A late one for this release of ‘from around the web’ after being on holiday for the last week – as the case always seems to be I’ve come out of the sun quite red. This week we have another step in the right direction to getting rid of passwords, some helpful templates for building a first config for a Palo Alto Networks Next Generation Firewall and an interesting (short) review of the Hubitat home automation hub.

New Azure Active Directory capabilities help you eliminate passwords at work
It’s been promised by Microsoft (and some others) for quite some time and it looks like another leap in the right direction has been made. With FIDO2 and devices like the YubiKey password less login on Windows 10 Azure AD domain joined devices is happening. Be sure to watch the video at the bottom of the page!

iron-skillet
All the options within a PAN NGFW can seem quite daunting and while the out of the box settings for security policies will help they are far from best practice. That’s where the IronSkillet comes in handy to take some of that pain away and give you a serious starting point.

Smart Home Hub – Hubitat Review
For the people who don’t have the time (or know how) to invest in something like Home Assistant but aren’t up for relying on a connection to the ‘cloud’ for home automation then Hubitat may well be for you. I’ve been exploring home automation for quite some time (at the moment using LIFX and HomeSeer) and may well consider looking into Hubitat some more if/when I decide to expand on it.

Always remember to save your config!As part of my new job I’ve taken on the management of a Palo Alto PA-3020, on my list of things to do…update the software/firmware on it. The update process its self is pretty simple in that you identify the version you are going to update to, download it, install it and then reboot the firewall at a time that will cause the least distribution to your users.

It will also be worth taking a save of your current running configuration – this can be done by going Device > Setup > Operations and Saving a named configuration snapshot and then exporting it.

At first glance there does not seem to be a way to schedule the reboot (for say 3am – something I particularly liked on my Smoothwall firewall) so for the time being I’ll have to deal with late night reboots.

Anyway the good bit! To upgrade from 6.0.6 to 6.1.0 took 4 minutes to then upgrade from 6.1.0 to 6.1.5 took 5 minutes 30 seconds.

For more information on the upgrade process from Palo Alto themselves visit this link – https://live.paloaltonetworks.com/docs/DOC-2092.

14/11/2018 Update

It’s firmware update time again, this time going from 7.1.14 to 7.1.21, from pressing restart it took about 2 minutes 25 seconds for a ping to the firewalls management interface to come back, 4 minutes 20 seconds for the web interface to come back and then 5 minutes 25 seconds (in total) for internet connectivity to be restored.