WirelessPhreak.com

This will be short and sweet, if you have privileges to boot your PC into safe mode you can follow the following steps to delete the affected update.

**Disclamer: This is only a guide please work with Microsoft and or Palo Alto Networks if you have any concerns. **

GlobalProtect VPN can be deployed in different connection configurations. One of the most secure is the always-connected model. When 'always on' is configured, the GlobalProtect agent will force all traffic over the VPN tunnel, even when a user is not logged in. This ensures that all traffic from the device is inspected by a firewall and allows desktop support staff to manage the device. One downfall is that it complicates communications with MDM solutions.

MDM software runs all the time, even when users are not logged in. What this means is the software needs to be allowed to access MDM resources 24x7. In GlobalProtect, this is accomplished with a mechanism called pre-login security policies. Pre-login policies are security policies that allow devices authenticated with a machine certificate to connect to generally a more restricted set of resources. Once a user authenticates the VPN connection, it is promoted to a known-user state and corporate firewall policies are applied to the traffic.

What I want to focus on in this write-up is the pre-login security policies that allow Intune software to communicate with its required Microsoft cloud resources.

1. The first thing that needs to happen is to determine which endpoints the Intune client will need to communicate with. This can be accomplished by running a PowerShell command on an endpoint, which will output the endpoints you will need to configure in your firewall. Here is a link to the Microsoft documentation for running the PowerShell commands. https://tinyurl.com/MS-Intune-Doc

2. Once you receive the endpoints, you will need to create a custom URL category and two address object groups.

    a. The URL category you need to create is for the *.manage.microsoft.com domain. Because this is a wildcard URL, you cannot create an FQDN object and will need to create a second security policy just for this.

    b. You will need to create an Intune-FQDN address object group and add the FQDNs that were part of the above PowerShell output.

    c. Lastly, you will need to create an Intune-Network address object group and add the network address objects that where generated in the above PowerShell output.

3. Configure security policies to utilize the address and URL categories you created above.

    a. The first security policy you need to configure is one that leverages your custom URL category. You will also want to leverage the applicable App-IDs.

    b.  The second policy will use the same App-IDs but will restrict the destination to the two address objects you created earlier.

    c. One thing I want to highlight is that in the user category, you see pre-login defined as the user. This is important as it ensures that certificate-authenticated devices can leverage these policies even though the users are not logged in.

Once these policies are configured, you will see Intune devices connect to your Intune console, and you will be able to utilize the core Intune services.

Self hosting apps and building out your home lab!

I wanted to create this blog post not as a step-by-step guide but as a high-level outline and links to the resources you can use to build your container environment. I have wanted to get into containers and Docker for a while. I have played with Docker in the past and had not had much success. I could get stuff running but to be able to manage the health of my containers and easily deploy and destroy them was not intuitive for a dumb network guy like myself.

So I found a better way!

The second piece that streamlines the home lab setup is Nginx Proxy Manager. This is a user Interface to the powerful Nginx web server. The NPM project has scripted many of the configurations you would have had to manually build out in the past and fronted it with a super intuitive user interface. NPM can even generate and manage your let's encrypt certificates. I can't say enough good things about NPM.

So what you need to get started

1. You will need a computer or even a Raspberry Pi (the Pi si a little under powered though).  You can run Windows, Apple OS, or Linux.  I used Linux there seems to be much more documentation running it in linux. 
2. Own a domain name so you can manage and create your own DNS records.
3. Set up port forwarding on your home router to roward traffci to your new container server.
4. Allow port 443 access on your local firewall if you are running in a VPS or at home.
5. Install Docker link to install Docker. https://docs.docker.com/engine/install/ubuntu/
   
6. Install Portainer here is a link their really great install docs. https://docs.portainer.io/start/install-ce/server/docker/linux
7. Install Nignx Proxy Manager  https://nginxproxymanager.com/setup/#running-the-app

Once this has all been build out you have the basic framework to deploy containerized applications at will. 

 

High level diagram of what your environment will look like

 

Helpful Hint

• When you deploy a container you need to add the container to the NGINX Proxy Manager Default network if you want the app to be fronted by NPM
  
• When you configure NPM you need to use a fully qualified name that will route to your public IP that will in turn forward it to the server and then from NPM to the correct container. 
• You can define the container in the NPM config by the name portainer assigns it.  You don't have to use the IP it was assigned. 
• NPM will perform port translation (your application can be presented on port 443 even though it listens on 8080.)
• NPM will offload SSL and force SSL redirects for apps that don't know they are behind a proxy.

 

 Some Self Hosted App Resources

 https://www.reddit.com/r/selfhosted/

 https://github.com/awesome-selfhosted/awesome-selfhosted

 

Lastly if your interested in an awesome Virtual Private Server (VPS) with unlimited bandwidth check out Frantech.  They are super cheap and super reliable, and they have awesome customer service. 

FYI this is an affiliate link so I will score a little cash if you buy. :)

FranTech

 The question is “why log everything?”

Logging your local SSH sessions can provide valuable information for troubleshooting, record-keeping, security, and auditing purposes. It is recommended to enable session logging as part of your SSH client configuration. Logging can save your bacon, for instance when:

• The telnet/SSH client buffer is full
• Something goes wrong
• You mistakenly close SecureCRT
• You want to check what you have done

The original guide was posted on Ciscozine.com. It was such a good article I wanted to capture it here and add some Apple screenshots for everyone.

Below the steps to configure it:

1. Open the software.

2. On the top bar click “Options”then “Global Options”.

3. Select “Default Session”, click “Edit Default Settings…”; then select “Log File”.

There are many customization's:Log file name: where to save the log file.
Upon connect: text at the beginning of the file.
Upon disconnect: text at the end of the file.
On each line: text added on each line.

These fields accept several variables; a complete list is shown below:%H – hostname
%S – session name
%Y – four-digit year
%M – two-digit month
%D – two-digit day of the month
%h – two-digit hour
%m – two-digit minute
%s – two-digit seconds
%t – three-digit milliseconds
%% – percent (%)
%envvar% – environment variable (for instance %USERNAME%)

Note: These settings will be applied ONLY on new sessions!

4. If you would apply these settings on the current saved sessions click “File” on the top bar then “Connect…”. Select the devices or the group of devices, right click and select “Properties”. A new window will appear:

You can customize each field as you prefer. In my case, I have used the previous settings.

Below an example of a saved session:
19:19:58.965 $ Start recording Test_Switch (192.168.0.10) - 19:19:58
19:19:58.983 $ C
19:19:58.983 $ *
19:19:58.984 $ *
19:19:58.984 $ * Test_Switch
19:19:58.984 $ *
19:19:58.985 $
19:20:00.950 $ Username: Cisco
19:20:00.980 $ Password:
19:20:00.980 $
19:20:48.403 $ Test_Switch#sh ver
19:20:48.620 $ Cisco IOS Software, s72033_rp Software (s72033_rp-ADVENTERPRISEK9-M), Version 15.1(2)SY, RELEASE SOFTWARE (fc4) 19:20:48.620 $ Technical Support: http://www.cisco.com/techsupport
19:20:48.620 $ Copyright (c) 1986-2013 by Cisco Systems, Inc.
19:20:48.620 $ Compiled Wed 04-Sep-13 13:05 by prod_rel_team
19:20:48.620 $
19:20:48.621 $ ROM: System Bootstrap, Version 12.2(17r)SX7, RELEASE SOFTWARE (fc1)
19:20:48.621 $ 19:20:48.621 $ SW-6500-VSS uptime is 23 weeks, 2 hours, 8 minutes
19:20:48.621 $ Uptime for this control processor is 23 weeks, 2 hours, 0 minutes
19:20:48.621 $ System returned to ROM by reload at 12:16:02 UTC Fri May 23 2014 (SP by reload)
19:20:48.622 $ System restarted at 14:20:04 CST Fri May 23 2014
19:20:48.622 $ System image file is "sup-bootdisk:s72033-adventerprisek9-mz.151-2.SY.bin"
19:20:48.622 $ Last reload reason: Admin reload CLI
19:20:48.622 $
19:20:48.622 $
19:20:48.624 $
19:20:48.624 $ This product contains cryptographic features and is subject to United
19:20:48.625 $ States and local country laws governing import, export, transfer and
19:20:48.625 $ use. Delivery of Cisco cryptographic products does not imply
19:20:48.625 $ third-party authority to import, export, distribute or use encryption.
19:20:48.625 $ Importers, exporters, distributors and users are responsible for
19:20:48.626 $ compliance with U.S. and local country laws. By using this product you
19:20:48.626 $ agree to comply with applicable laws and regulations. If you are unable
19:20:48.626 $ to comply with U.S. and local laws, return this product immediately.
19:20:48.626 $
19:20:48.626 $ A summary of U.S. laws governing Cisco cryptographic products may be found at:
19:20:48.626 $ http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
19:20:48.626 $
19:20:48.627 $ If you require further assistance please contact us by sending email to
19:20:48.627 $ [email protected].
19:20:48.627 $
19:20:48.627 $ cisco WS-C6509-E (R7000) processor (revision 1.6) with 983008K/65536K bytes of memory.
19:20:48.627 $ Processor board ID SMC17330086
19:20:48.957 $ SR71000 CPU at 600Mhz, Implementation 0x504, Rev 1.2, 512KB L2 Cache 19:20:48.958 $ Last reset from s/w reset
19:20:48.958 $ 12 Virtual Ethernet interfaces
19:20:48.958 $ 216 Gigabit Ethernet interfaces
19:20:48.958 $ 36 Ten Gigabit Ethernet interfaces
19:20:48.958 $ 1917K bytes of non-volatile configuration memory.
19:20:48.958 $ 19:20:48.959 $ 65536K bytes of Flash internal SIMM (Sector size 512K).
19:20:48.959 $ Configuration register is 0x2102
19:20:48.960 $ 19:20:59.632 $ Test_Switch#
19:22:23.284 $ Test_Switch#exit
19:22:23.585 $ Stop recording Test_Switch (192.168.0.10) - 19:22:23

As you can see, each line start with the time. The “$” is used for two reasons:If you import the log file in Excel or similar, you can use this symbol as a delimiter.
I use the “$” and not the “,” because in some configuration the “,” is present, so it would not be possible to use this symbol like a delimiter.