topic Re: i see a user name on the blocked pages which is different from the user i loged in AciveDirectory. in General Topics

i see a user name on the blocked pages which is different from the user i loged in AciveDirectory.

oguz_korkmaz — Tue, 15 Nov 2011 12:08:32 GMT

Hi i have a problem,i logged in with mydomain\jame to my computer,and i tried to access filtered url and see different user name on the warning page to that category.why is this happening,is there any idea?

Re: i see a user name on the blocked pages which is different from the user i loged in AciveDirectory.

DavePalo — Tue, 15 Nov 2011 13:09:36 GMT

Hi,

Please could you provide a bit more info?

Are you on a computer that only you use?

Could another user have been logged into that computer recently? IP to username mapping only occurs periodically.

Are you logging in to a server using remote desktop or similar?

Regards,

Dave

Re: i see a user name on the blocked pages which is different from the user i loged in AciveDirectory.

oguz_korkmaz — Tue, 15 Nov 2011 13:18:22 GMT

i access the system on an rdp session and i am using a user which has domain administrator priviliges,when i first loged in the server i tried to access the web and blocked,on the browser i see my logon user name,after 5 minutes i tried this agein clearing the browser cache,i saw the user mydomain\administrator user on the blocked page.

another system,this is just mentioned me today from oen of my clients,he says, the same error but this time he is accesing the user

hisdomain\james to the computer and again see the right user name for 5 minutes nearly,after than he sees hisdomain\jonny on the blocked page error.

Re: i see a user name on the blocked pages which is different from the user i loged in AciveDirectory.

DavePalo — Tue, 15 Nov 2011 13:33:00 GMT

Does your RDP server have the Terminal Services agent running on it?

If you are using a shared system with just the user agent running against AD then this sort of thing can happen. If multiple users are logging in from the same IP the Palo will just use the latest IP to username mapping it has.

The Terminal Services agent addresses this I believe. I have not used it myself yet though.

Regards,

Dave

Re: i see a user name on the blocked pages which is different from the user i loged in AciveDirectory.

oguz_korkmaz — Tue, 15 Nov 2011 13:46:43 GMT

no,terminal server agent is not running.and i want to point out that the second system is more important becouse the local user troubles with this problem on the local site not an rdp session occurs during this situtation.

Re: i see a user name on the blocked pages which is different from the user i loged in AciveDirectory.

DavePalo — Tue, 15 Nov 2011 14:05:21 GMT

So the user is logging into his own PC and there is nobody else logged into the same computer?

Is the user authenticating as another user for anything on the PC (perhaps a service)?

Is the user on the same network as the AD used for IP to username mapping? If multiple users are on a different network from AD and NAT is occuring in between, multiple users may again get mapped to the same IP.

Regards,

Dave

Re: i see a user name on the blocked pages which is different from the user i loged in AciveDirectory.

oguz_korkmaz — Tue, 15 Nov 2011 14:42:59 GMT

i will search these,but assume that your assumptions are not true,what another cases causes a situation like this,i am asking this becouse the time period thanks fpr your answer.

Re: i see a user name on the blocked pages which is different from the user i loged in AciveDirectory.

DavePalo — Tue, 15 Nov 2011 14:52:32 GMT

Please can you check

1) If the IP address in the Palo log matches the IP address assigned to the client (ipconfig /all) or is a different one

2) How many other users have recent entries in the log appearing to come from the same IP

3) OS of client machine

Thanks

Re: i see a user name on the blocked pages which is different from the user i loged in AciveDirectory.

oguz_korkmaz — Tue, 15 Nov 2011 15:15:12 GMT

hi i recognized a situation while i am analyzing the logs;

here it is comming,10.10.10.15 ip address is mapping with different users,when i checked from dns 10.10.10.15 is a terminal server,so we can continue from here,i understood that when a user logins this terminal server another one is discnnecting and newly connected user accesing the internet,am i right ?and is so what can i do to stop this situtation?

Re: i see a user name on the blocked pages which is different from the user i loged in AciveDirectory.

DavePalo — Tue, 15 Nov 2011 15:20:39 GMT

Yes that would explain it then. I believe that the terminal services agent is for just this situation. As I mentioned earlier I have not used this myself though.

Regards,

Dave

Re: i see a user name on the blocked pages which is different from the user i loged in AciveDirectory.

oguz_korkmaz — Tue, 15 Nov 2011 15:43:35 GMT

thanks,i will search about terminal server agent then.

Re: i see a user name on the blocked pages which is different from the user i loged in AciveDirectory.

DavePalo — Tue, 15 Nov 2011 15:51:59 GMT

You can download it from Palo Alto support. I'm sure there is an install guide somewhere.

I know it needs to be installed each Terminal Server.

Good luck

Regards,
Dave

Re: i see a user name on the blocked pages which is different from the user i loged in AciveDirectory.

oguz_korkmaz — Wed, 16 Nov 2011 14:55:54 GMT

hi there is another problem i want to talk about,i am describing a rule without no restricton to my user name,and moving the rule top of the liist,than i try to access the internet at first it is cool i cn access everywhere but in a short time,i am blocked with a different user name,when i check the palo alto monitor,i see that i am using my full_access rule for a short time but than i am matching with restricted rule with the user name seen on the blocked page.

so i understood that this is a complication of terminal server usage,but is this normal to match with a restricted rule when i create a rule without no restriction to my username?

Re: i see a user name on the blocked pages which is different from the user i loged in AciveDirectory.

DavePalo — Wed, 16 Nov 2011 15:08:39 GMT

Hi,

I think this is all the same problem.

That rule will only be used during the period that the Palo has your IP address mapped to your username.

If you have multiple users on your terminal server then the terminal server agent should be installed.

Regards,

Dave

Re: i see a user name on the blocked pages which is different from the user i loged in AciveDirectory.

oguz_korkmaz — Wed, 16 Nov 2011 15:29:31 GMT

Hi dyoung thanks for your advices,i will try it and share the result for assistant of other palo alto users.