Palo Alto Firewall Packet Capture

Packet capture is very useful when you troubleshoot network connectivity issues or monitor suspicious activity.

Diagram

Few things to consider

1. Four packet capture filters can be added with a variety of attributes.
2. Packet captures are session/flow based, so having a single filter is enough for capturing both inbound and outbound traffic.

Packet Capture Stages

There are four stages:

1. drop - where packets get discarded. Example, security polciy denying the traffic
2. firewall - captures packets in the firewall stage.
3. receive - captures the packets as they ingress the firewall interface before they go into the firewall engine (pre-NAT)
4. transmit - captures packets as they egress out of the firewall engine (post-NAT)

Example 1 - Packet Capture without NAT

Initiate a ping from CLIENT to the SERVER and capture both ICMP echo request and ICMP echo reply.

You can configure packet capture by going to Monitor > Packet Capture

• Packets 1 & 2 are ingressing the firewall
• Packets 3 & 4 are egressing the firewall
• Packets 1 & 3 are the same
• Packets 2 & 4 are the same

Step 1 - Configure capture filters

The filter shown below captures both echo request and echo reply on Continue reading

Patrick Finn: why I joined Cloudflare as VP Sales for the Americas

I’m delighted to be joining Cloudflare as Vice President of Sales in the US, Canada, and Latin America.

I’ve had the privilege of leading sales for some of the world’s most iconic tech companies, including IBM and Cisco. During my career I’ve led international teams numbering in the thousands and driving revenue in the billions of dollars while serving some of the world's largest enterprise customers. I’ve seen first-hand the evolution of technology and what it can achieve for businesses, from robotics, automation, and data analytics, to cloud computing, cybersecurity, and AI.

I firmly believe Cloudflare is well on its way to being one of the next iconic tech companies.

Why Cloudflare

Cloudflare has a unique opportunity to help businesses navigate an enduring wave of technological change. There are few companies in the world that operate in the three most exciting fields of innovation that will continue to shape our world in the coming years: cloud computing, AI, and cybersecurity. Cloudflare is one of those companies. When I was approached for this role, I spoke to a wide range of connections across the financial sector, private companies, and government. The feedback was unanimous that Cloudflare is poised on the edge Continue reading

Introducing Stream Generated Captions, powered by Workers AI

With one click, customers can now generate video captions effortlessly using Stream’s newest feature: AI-generated captions for on-demand videos and recordings of live streams. As part of Cloudflare’s mission to help build a better Internet, this feature is available to all Stream customers at no additional cost.

This solution is designed for simplicity, eliminating the need for third-party transcription services and complex workflows. For videos lacking accessibility features like captions, manual transcription can be time-consuming and impractical, especially for large video libraries. Traditionally, it has involved specialized services, sometimes even dedicated teams, to transcribe audio and deliver the text along with video, so it can be displayed during playback. As captions become more widely expected for a variety of reasons, including ethical obligation, legal compliance, and changing audience preferences, we wanted to relieve this burden.

With Stream’s integrated solution, the caption generation process is seamlessly integrated into your existing video management workflow, saving time and resources. Regardless of when you uploaded a video, you can easily add automatic captions to enhance accessibility. Captions can now be generated within the Cloudflare Dashboard or via an API request, all within the familiar and unified Stream platform.

This feature is designed with Continue reading

HPE Goes After Enterprise AI With Nvidia GPU Engines

This week is another major conference for a server OEM, and that must mean it is another time for an OEM to announce its tight partnership with AI compute engine juggernaut Nvidia. …

HPE Goes After Enterprise AI With Nvidia GPU Engines was written by Jeffrey Burt at The Next Platform.

NAN066: Operationalize Your Automations With torero (Sponsored)

D2C245: Don’t Fear Database DevOps

50 Years Later, Vint Cerf and Bob Kahn Remember the Birth of TCP/IP

Last month viewers from 56 countries tuned in for a very special livestreamed event: The Institute of Electrical and Electronics Engineers reunited 80-year-old a special presentation from the very room where they first wrote the TCP/IP protocol together more than 50 years ago. “It’s truly an exciting honor to be here to celebrate the 50th anniversary of the work that Bob Kahn and I started, and so many have contributed to,” Cerf said during a Google vice president and their chief internet evangelist. Kahn is now chair and CEO of the not-for-profit

D-Wave Is Still Making The Case For Annealing Quantum Computing

Murray Thom, vice president for quantum technology evangelism for D-Wave, knows that his company for more than two decades has played a key role in a somewhat unusual industry. …

D-Wave Is Still Making The Case For Annealing Quantum Computing was written by Jeffrey Burt at The Next Platform.

PP019: The God Accounts: Cloud IAM

HS075: How to Ask Questions

Automated Validation of BGP Labs

In late 2023, I started playing with the idea of having automated validation in netlab. The early implementation was used in BGP labs, and a user liked it so much that he opened an issue saying:

I would suggest providing netlab validate for each lab.

Numerous rounds of yak-shaving later, I merged a humongous commit that adds automated validation to these lab exercises:

Automated Validation of BGP Labs

In late 2023, I started playing with the idea of having automated validation in netlab. The early implementation was used in BGP labs, and a user liked it so much that he opened an issue saying:

I would suggest providing netlab validate for each lab.

Numerous rounds of yak-shaving later, I merged a humongous commit that adds automated validation to these lab exercises:

NB483: Cisco Hopes To Be Ikea For AI Infrastructure; Is Anyone Besides Nvidia Making Money From AI?

Live Training: Build Your Own Networking Lab

This Friday at 1pm ET, Bruce McDougall and I are teaching a live class on using Containerlab to build and automate network labs. From the course description:

This course will guide learners through the tools and techniques to build virtual labs either locally or on common cloud services, so you can become more proficient at understanding, designing, monitoring, and troubleshooting networks. The course begins with obtaining and starting the basic tools required to build and test network labs using open-source and freely available tools. The instructors will build a variety of network topologies, including data center and campus, to help learners understand how to test in different environments.

Register here.

Tech Bytes: Journey to SSE with HPE Aruba Networking (Sponsored)

netlab 1.8.3: RIPv2, BGP Route Servers

During the ITNOG8 netlab presentation, I jokingly said something along the lines “all that’s missing is RIPv2 and Babel.” That’s no longer true; someone asked me how hard it would be to add RIPv2 to netlab, and I said, “give me a few days 😎”

Other new features in netlab release 1.8.3 include support for BGP route servers (and route server clients), BGP Link Bandwidth community, and OSPF/BGP validation plugins for Arista EOS, Cumulus Linux and FRR. We also fixed the installation scripts to work with Ubuntu 24.04 and Debian Bookworm.

For more details, read the release notes.

netlab 1.8.3: RIPv2, BGP Route Servers

During the ITNOG8 netlab presentation, I jokingly said something along the lines “all that’s missing is RIPv2 and Babel.” That’s no longer true; someone asked me how hard it would be to add RIPv2 to netlab, and I said, “give me a few days 😎”

Other new features in netlab release 1.8.3 include support for BGP route servers (and route server clients), BGP Link Bandwidth community, and OSPF/BGP validation plugins for Arista EOS, Cumulus Linux and FRR. We also fixed the installation scripts to work with Ubuntu 24.04 and Debian Bookworm.

For more details, read the release notes.

Network Observability with SuzieQ: Part Three

In part 2 of this multipart series on network observability with SuzieQ, we looked at how to setup SuzieQ using docker compose. In this part, we will look at how to interact with the data collected by SuzieQ using the command line interface (CLI) and its REST API.

If you have not read Part One and Part Two yet, I recommend you read it first before proceeding with this part.

SuzieQ CLI

SuzieQ provides a command line interface to interact with the data it has collected. Like any Linux CLI, SuzieQ CLI providers command completion when options are available and also provides help for each command. All commands follow a common structure <table_name> <verb> <filters>. This will make more sense when we start looking at some examples.

Let us start by running the SuzieQ CLI. If you have been following along with the previous parts, you should have the SuzieQ docker container running and you can connect to the SuzieQ CLI by running the docker attach suzieq_cli command. Once you are connected, you will see a prompt like this suzieq>. This is the SuzieQ CLI prompt.

root@sudarshanv:/suzieq/suzieq# docker attach suzieq_cli
suzieq>

From here you can get Continue reading

Palo Alto – Find and Remove Unused Objects

If you work with Palo Alto firewalls, you might know there's no straightforward way to find and remove unused address objects. When I googled for solutions, I found that others suggested using Expedition or some kind of automation. In this blog post, I'll show you a very simple script to find these objects and remove them if needed.

Expedition or Automation

I tried using Expedition a few years back, but it required a dedicated VM, and I struggled to wrap my head around how to use it. I just needed a simple solution. While I could also use Palo Alto's REST API or even the Python SDK, setting everything up takes a bit more time.

Palo Alto 'Set' Commands

Then it occurred to me that Palo Alto provides 'set' commands, and you can use the 'delete' version of those commands to remove something. With that in mind, I thought, "Hmm, what if I get the whole config from either the firewall or Panorama in the 'set' format, run it through a regex, and extract all the object names?" Once I have the object names, I can go through the configuration line by line to check if the objects are Continue reading

The Increasing Impatience Of The Speed Of The PCI-Express Roadmap

Richard Solomon has heard the rumblings over the years. As vice president of PCI-SIG, the organization that controls the development of the PCI-Express specification, he has listened to questions about how long it takes the group to bring the latest spec to the industry. …

The Increasing Impatience Of The Speed Of The PCI-Express Roadmap was written by Jeffrey Burt at The Next Platform.