Explore the Community
Cato Cloud
Cato and SASE discussions and best practices.
API
API questions-and-answers, discussions, and best practices.
Recent Content
Is there any way to expose/export DHCP logs from Cato SDP clients?
is there any way (events / API) to see DHCP events for our SDP users? Our security vendors (Rapid7 and Defender for Identity) are doing correlation based on DNS and DHCP events and sometimes see SDP addresses as different machines. I have DNS and PTR records updating but am curious if there is any way to expose the DHCP lease events for SDP users. I see those events for other Cato DHCP but not for SDP users in my tenant. Cato has the concept of "User Awareness" that is correlating IP addresses to User IDs. When we were using Windows DHCP servers we fed the logs to our security vendors for a similar type of correlation between IP addresses and User IDs. As we are moving away from Windows Servers in our offices, we are losing this visibility. We are beginning to allow Cato to provide the DHCP on our LAN segments, as well as for our remote SDP client users. As this happens, we are seeing DHCP events on the LAN segments which can be tied to machine names and matched against login events via active directory or Entra ID to correlate IP addresses to users. However, for our remote SDP client users I cannot seem to find DHCP events. This leads to issues. Microsoft Defender for Endpoint sees a user getting different IP remote SDP client addresses in the 10.41.x.x as "Pass the Hash" attacks. However, when I investigate, it is the same workstation being getting different IP addresses through normal, remote operation. If the user does not reboot/login every day this raises security alerts. Am I missing the point, or not configuring something correctly? Is there a way via API or syslog forwarding to monitor DHCP logs from Cato for both LAN segments and SDP client segments? The ultimate solution would be log forwarding type of solution where I could forward all Cato DHCP lease events to Microsoft Defender for Endpoints/Identity and my security vendor (Rapid7) but I am just wondering how others are handling this. I figured I would ask around before I put something in the Idea hub for a non-issue.
Migration SCIM to SCIM Provisioning
Hello Team, We currently use Okta for SSO and SCIM provisioning with Cato. We want to keep SSO authentication on Okta, but move provisioning from Okta to Saviynt. Our Understanding: - We understand SCIM endpoints are scoped per directory (sourceId) as /scim/v2/{accountId}/{sourceId}. - We also noted documentation stating multiple IdPs are supported, but not recommended as a migration method. Could you please advise the following? Is there a recommended procedure to migrate existing users from an Okta SCIM directory to a new Saviynt SCIM directory? If adding a new SCIM directory is not recommended for migration, please point us to the recommended migration steps or best practices. We want users and groups provisioned via Saviynt to authenticate via Okta SSO. Is mapping Saviynt directory to the Okta SSO provider a possible configuration? Please let us know if you have any recommend plan. Thank you,Degraded Sockets in High Availability
I have multiple customers that have a LTE sim card just for the main socket. This will have the sockets identify asymmetric WAN connections causing the DEGRADED alert. What can I do to disable the DEGRADED alarm from the site? could it be possible to disable the interfaces so the asymmetric connections don't show as alarmed?
LAN Firewall rules - missing "IP range" in src/dst
Anyone else missing an ability to use Custom IP Range as a source or destination in LAN Firewall rule? We use CATO LAN Firewall to control traffic between two separate network zones terminated on two different internal firewalls. Since this is a local traffic in the site, we don't want to route it to Cato Cloud so it's not dependent on WAN links. That's why we use CATO LAN Firewall (formerly Local Routing). But the only options to set Source or Destination are: Global range, Host, Interface subnet, Network Interface and Any. Would be very useful if we can use Custom IP ranges and Host Groups there.
Pre-Login and Online Services
We currently have an on-premises Active Directory and have Pre-Login enabled with connect at boot enabled. We defined internal destinations (domain domain controllers) as allowed destinations, so the devices can reach the domain controllers before the user has logged in. This worked fine so far. However, now we want to migrate to Entra ID and Intune only, which means that the machines now need to reach Entra and Intune before or directly after the login. Since the pre login mode doesn't allow them to reach all URLs of Entra ID and Intune, we get problems during log in and for the Intune enrollement (which happens after the login of a new user but before the user has authenticated with the CATO client). We also have the same problem with NinjaOne which we use to manage endpoints: We would like to be able to reach endpoints before a user has logged in. In the allowed destinations for the Pre login mode, I can only provide internal targets and IPs, but can't put any Internet hostnames so the devices can reach Entra ID and Intune before the user has authenticated. So what is the solution here? We want to use Pre login to have the security it provides and prevents the devices from having open Internet access before the user has authenticated with CATO, but really need to resolve these issues that are caused by it when it comes to connect to our management services before the user has authenticated. Thank you in advance.
Container based FQDN addition- Anomaly behaviour
Dear All, I get malicious domain and IPs to block from my regulator. Instead of manually adding IPs and domain, I created Container and than get it sync with Raw Github for both IPs and FQDN. The FQDN and IPs are syncing correctly in CMA. To test, I added "linkedin.com" to malicious domain in container and created Internet Firewall rule to block for this container. When I browse "linkedin.com", I get block page but as soon as I type "www.linkedin.com", it opens and not get blocked. Since there is only option of either IP or FQDN to be added in Cato Container, now due to this limitation, my purpose is not solved. Ideally it should block all subdomains as well but it only blocks if FQDN is browsed. So with this, malicious attacker URLs will not be blocked. Cato should provide option to add "Domain" as well along with IP and FQDN as this is not solving the problem of blocking malicious domain basis threat feeds received from regulator. Cato Product should look into this.
Featured Content
