topic Re: User Agent and Active Directory 2008 in General Topics

User Agent and Active Directory 2008

bdaussin — Tue, 05 Apr 2011 04:32:51 GMT

I would like to know if there are some known issues about communications between useragent and AD2008 ?

We are migrating from AD2003 to AD2008 and some User-ID associations are missed :smileyangry:

We are not using security logs at the moment but only the session table monitoring.

We already have opened a case but I would like to share this experience.

We also encountered some issues with Juniper Firewall and AD2008. The ALG MS-RPC features based on UUID matching no longer works.

Is the UUID used by Palo Alto agents when communicating with the AD ?

Thanks for your help.

Re: User Agent and Active Directory 2008

mharding — Tue, 05 Apr 2011 12:51:03 GMT

Are you logging succes and failures for the "audit account logon events" and "audit logon events' on the domain controllers?

Re: User Agent and Active Directory 2008

bdaussin — Wed, 06 Apr 2011 02:59:54 GMT

No, not yet. We plan to do it with AD2008. We do not anderstand why some identification are missed now ( 2008 vs 2003 ).

Re: User Agent and Active Directory 2008

bdaussin — Thu, 26 May 2011 15:50:18 GMT

The root cause of this issue starts becoming more accurate :

When an anonymous event comes from a user PC to the DC ( which has already been recognized by the AD agent ), here is the behaviour :

With DC2003, the AD agent get the field "sesi10_username" with an empty value, which has no effect on the Pan Agent.

With DC2008R2, the AD agent get the field "sesi10_username" with the value ANONYMOUS LOGON, which cause the PAN agent to overwrite the previous UserID-IP identification.

So, how to turn around this issue ? Is there a way on the agent to ignore ANONYMOUS LOGON ?

Thanks for your help.

Re: User Agent and Active Directory 2008

dagibbs — Sun, 29 May 2011 23:18:37 GMT

bdaussin wrote:

The root cause of this issue starts becoming more accurate :

When an anonymous event comes from a user PC to the DC ( which has already been recognized by the AD agent ), here is the behaviour :

With DC2003, the AD agent get the field "sesi10_username" with an empty value, which has no effect on the Pan Agent.

With DC2008R2, the AD agent get the field "sesi10_username" with the value ANONYMOUS LOGON, which cause the PAN agent to overwrite the previous UserID-IP identification.

So, how to turn around this issue ? Is there a way on the agent to ignore ANONYMOUS LOGON ?

Thanks for your help.

In the Palo Alto agent directory, create a file called "ignore_user_list.txt"

Add your "ANONYMOUS LOGON" to this file - you may need to put it in quotes, like I jsut did, as there is a space in the username.

See if this works.

Cheers!

Re: User Agent and Active Directory 2008

bdaussin — Tue, 07 Jun 2011 12:36:41 GMT

Thanks for your advice and workaround. We set up this file on the AD agent, but it seems that it filters out all informations coming from the DC session table

We have opened a case to the support but it's quite long to get a usefull answer :smileyangry:

Thanks,