topic Re: Unable to get exchange logs in General Topics

Unable to get exchange logs

errevisystem — Wed, 13 Mar 2013 18:08:28 GMT

Hi,

I have a PA500 on PANOS 4.1.9

I'm doing some testing with Exchange, managing to get logs to identify iphones, ipads and android devices without a Captive Portal.

Installed USER-ID agent version 5.0.2-2 on a DC, done auto discovery, removed all DCs and left only Exchange Server. It shows up as "connected".

After that, i've tried syncing mails via WI-FI on iphone, android and also windows phone but no way of getting some IP to USER mapping.

Anyboy was able to get to work?

What am i doing wrong?

Thanks

Sergio

Re: Unable to get exchange logs

fnichelson — Thu, 14 Mar 2013 13:49:23 GMT

I hope you get an answer to this, I've been trying ways to get this to work for all the Apple/Android devices and even laptops with BYOD. So far no luck.

Re: Unable to get exchange logs

mharding — Thu, 14 Mar 2013 14:54:40 GMT

I would be interested as well. I've never seen it work on our setup. The last time I looked at it, it showed the user authenticated with the Exchange server IP address. Not quite the desired result.

Re: Unable to get exchange logs

mharding — Fri, 15 Mar 2013 20:36:03 GMT

I tested a little bit today, and here's what I experienced:

I created a security policy and captive portal policy that would exclude our BOYD devices from the captive portal page.
The UserID Agent was pointed at the Exchange 2010 CAS server.
The native ActiveSync client client doesn't appear to generate the right kind of logs, but if I went to the Outlook Web App page and logged in, I would see my account show up in the UserID Agent.

Re: Unable to get exchange logs

jteetsel — Sat, 10 Aug 2013 00:56:23 GMT

Hello, I may be a little late but this should work for both OWA and Active sync connections, The most common reason for the Exchange mappings not appearing is that logon events are not being audited on the Client Access Server. The user ID agent uses events 4624 or 4648 to collect user to IP mapping info. If your Exchange Server is not a domain controller the auditing for such events it likely to not configured.