HTTP Header - Logging NTLM Username

[ASCIT]

My PA firewall inspects traffic between my users and proxy server. The proxy server provides NTLM authentication. Is there a way of logging the NTLM authenticated username within the http headers?

[HULK]

Hello Ascit,

I am not clear, what you want to achieve. HTTP header is not having a field for user. Could you please explain your requirement here in details.

Check out this discussion thread:

Re: Captive portal, manage authenticated users

Thanks

[Dz3015]

HULK, in this instance the PA is not acting as the proxy it sound like.  The PA is in between the proxy and the user and is able to inspect that traffic.

ascit, I believe that the NTLM portion of the traffic is not within the HTTP header but in a separate NTLM header in the packet.  I don't know if the PA would recognize the traffic separately once it ID's the traffic as HTTP.

[ASCIT]

Correct, I'm hoping to some how log the NTLM User name field:

[reaper]

Hi Ascit

The firewall can not log this specific entry as a straight forward log option.

It can however be inspected to trigger a custom app or custom threat.

Through captive portal the firewall can also provide ntlm user authentication or could be configured to receive syslog from the proxy containing user information

Video Link : 1317

How to Configure Captive Portal

How to Locate the Predefined Syslog Filters in PAN-OS

hope this helps

Tom

[kdd]

Hi ascit,

if you just want to identify the user coming from proxy, then there is a way to find out who it is.

Therefor the x-forwarded-for field has to be enabled on proxy and PA.

On PA:

to find out which ip-adress it is look into the URL-log:

to get filled the URL-log you need the URL-license. Maybe this result is not what you need but that is what is possible right now.

Regards,

Klaus

[kdd]

Hi ascit,

if you just want to identify the user coming from proxy, then there is a way to find out who it is.

Therefor the x-forwarded-for field has to be enabled on proxy and PA.

On PA:

to find out which ip-adress it is look into the URL-log:

to get filled the URL-log you need the URL-license. Maybe this result is not what you need but that is what is possible right now.

Regards,

Klaus