topic HTTP Header - Logging NTLM Username in General Topics

HTTP Header - Logging NTLM Username

ASCIT — Fri, 30 Jan 2015 05:23:00 GMT

My PA firewall inspects traffic between my users and proxy server. The proxy server provides NTLM authentication. Is there a way of logging the NTLM authenticated username within the http headers?

Re: HTTP Header - Logging NTLM Username

HULK — Fri, 30 Jan 2015 07:30:00 GMT

Hello Ascit,

I am not clear, what you want to achieve. HTTP header is not having a field for user. Could you please explain your requirement here in details.

Check out this discussion thread:

Re: Captive portal, manage authenticated users

Thanks

Re: HTTP Header - Logging NTLM Username

Dz3015 — Fri, 30 Jan 2015 14:06:36 GMT

HULK, in this instance the PA is not acting as the proxy it sound like. The PA is in between the proxy and the user and is able to inspect that traffic.

ascit, I believe that the NTLM portion of the traffic is not within the HTTP header but in a separate NTLM header in the packet. I don't know if the PA would recognize the traffic separately once it ID's the traffic as HTTP.

Re: Re: HTTP Header - Logging NTLM Username

ASCIT — Mon, 02 Feb 2015 05:51:51 GMT

Correct, I'm hoping to some how log the NTLM User name field:

Re: Re: HTTP Header - Logging NTLM Username

reaper — Mon, 02 Feb 2015 07:29:43 GMT

Hi Ascit

The firewall can not log this specific entry as a straight forward log option.

It can however be inspected to trigger a custom app or custom threat.

Through captive portal the firewall can also provide ntlm user authentication or could be configured to receive syslog from the proxy containing user information

Video Link : 1317

How to Configure Captive Portal

How to Locate the Predefined Syslog Filters in PAN-OS

hope this helps

Tom

Re: HTTP Header - Logging NTLM Username

kdd — Fri, 19 Jun 2015 08:52:54 GMT

Hi ascit,

if you just want to identify the user coming from proxy, then there is a way to find out who it is.

Therefor the x-forwarded-for field has to be enabled on proxy and PA.

On PA:

to find out which ip-adress it is look into the URL-log:

to get filled the URL-log you need the URL-license. Maybe this result is not what you need but that is what is possible right now.

Regards,

Klaus

Re: HTTP Header - Logging NTLM Username

kdd — Fri, 19 Jun 2015 10:16:10 GMT

Hi ascit,

if you just want to identify the user coming from proxy, then there is a way to find out who it is.

Therefor the x-forwarded-for field has to be enabled on proxy and PA.

On PA:

to find out which ip-adress it is look into the URL-log:

to get filled the URL-log you need the URL-license. Maybe this result is not what you need but that is what is possible right now.

Regards,

Klaus