About minow

The organization policy is to block ZIP file types. We are having problems with docx file type which they are a ZIP file but in the file blocking profile I can see Paloalto should know how to recognize docx files but we still get drops i would like to know how this machanism is working please review attached file ... View more

Hey why PA doesnt do SSL Decryption for this site: WeTransfer i can see PA is recognizing it as this application: wetransfer but ican see the original Go daddy ceritifcate in the browser windows, and in the PA logs i cannot see "decrypted" on this traffic why is this? this is my decryption policy: ------------------------------------------------------------------------------------------------------------------------------------------------------------------ admin@PA-500# show rulebase decryption rules rules {   "no Decrypt" {     category any;     type {       ssl-forward-proxy;     }     from trust;     to untrust;     source any;     destination Hilan3-192.168.210.154;     source-user any;     negate-source no;     negate-destination no;     action no-decrypt;     disabled no;   }   Decrypt {     category any;     type {       ssl-forward-proxy;     }     from trust;     to untrust;     source any;     destination any;     source-user any;     negate-source no;     negate-destination no;     action decrypt;     disabled no;   } } this is one of the session opened to the IP ------------------------------------------------------------------------------------------------------------------------------------------------------------------ admin@PA-500> show session id 21323 Session           21323         c2s flow:                 source:      192.168.1.149 [trust]                 dst:         173.241.240.180                 proto:       6                 sport:       52891           dport:      443                 state:       ACTIVE          type:       FLOW                 src user:    unknown                 dst user:    unknown         s2c flow:                 source:      173.241.240.180 [untrust]                 dst:         192.168.1.149                 proto:       6                 sport:       443             dport:      52891                 state:       ACTIVE          type:       FLOW                 src user:    unknown                 dst user:    unknown         start time                    : Wed Jun 26 13:34:22 2013         timeout                       : 30 sec         time to live                  : 19 sec         total byte count(c2s)         : 1792         total byte count(s2c)         : 4725         layer7 packet count(c2s)      : 9         layer7 packet count(s2c)      : 10         vsys                          : vsys1         application                   : wetransfer         rule                          : rule1         session to be logged at end   : True         session in session ager       : True         session synced from HA peer   : False         layer7 processing             : completed         URL filtering enabled         : True         URL category                  : online-personal-storage         session via syn-cookies       : False         session terminated on host    : False         session traverses tunnel      : False         captive portal session        : False         ingress interface             : ethernet1/2         egress interface              : ethernet1/1         session QoS rule              : N/A (class 4)         session tracker stage l7proc  : ctd err bypass admin@PA-500> ... View more

heyy i tried to troubleshoot some traffic behaviuor, an i created a rull without any security profile and with application overide. when i run those commands to look at the traffic i found this. admin@PA-500> show session all filter destination 147.235.246.154 -------------------------------------------------------------------------------- ID      Application    State   Type Flag  Src[Sport]/Zone/Proto (translated IP[Port]) Vsys                                      Dst[Dport]/Zone (translated IP[Port]) -------------------------------------------------------------------------------- 19110   Jumbomail      ACTIVE  FLOW       192.168.1.149[58525]/trust/6  (192.168.1.149[58525]) vsys1                                     147.235.246.154[80]/untrust  (147.235.246.154[80]) 8439    Jumbomail      ACTIVE  FLOW       192.168.1.149[58524]/trust/6  (192.168.1.149[58524]) vsys1                                     147.235.246.154[80]/untrust  (147.235.246.154[80]) admin@PA-500> admin@PA-500> admin@PA-500> show session id 8439 Session            8439         c2s flow:                 source:      192.168.1.149 [trust]                 dst:         147.235.246.154                 proto:       6                 sport:       58524           dport:      80                 state:       ACTIVE          type:       FLOW                 src user:    unknown                 dst user:    unknown         s2c flow:                 source:      147.235.246.154 [untrust]                 dst:         192.168.1.149                 proto:       6                 sport:       80              dport:      58524                 state:       ACTIVE          type:       FLOW                 src user:    unknown                 dst user:    unknown         start time                    : Tue Jun 25 18:06:37 2013         timeout                       : 3600 sec         time to live                  : 3584 sec         total byte count(c2s)         : 670         total byte count(s2c)         : 122         layer7 packet count(c2s)      : 3         layer7 packet count(s2c)      : 2         vsys                          : vsys1         application                   : Jumbomail         rule                          : rule1         session to be logged at end   : True         session in session ager       : True         session synced from HA peer   : False         layer7 processing             : completed         URL filtering enabled         : True         URL category                  : any         session via syn-cookies       : False         session terminated on host    : False         session traverses tunnel      : False         captive portal session        : False         ingress interface             : ethernet1/2         egress interface              : ethernet1/1         session QoS rule              : N/A (class 4)         session tracker stage l7proc  : fastpath state none admin@PA-500> show session id 19110 Session           19110         c2s flow:                 source:      192.168.1.149 [trust]                 dst:         147.235.246.154                 proto:       6                 sport:       58525           dport:      80                 state:       ACTIVE          type:       FLOW                 src user:    unknown                 dst user:    unknown         s2c flow:                 source:      147.235.246.154 [untrust]                 dst:         192.168.1.149                 proto:       6                 sport:       80              dport:      58525                 state:       ACTIVE          type:       FLOW                 src user:    unknown                 dst user:    unknown         start time                    : Tue Jun 25 18:06:37 2013         timeout                       : 30 sec         time to live                  : 17 sec         total byte count(c2s)         : 242         total byte count(s2c)         : 122         layer7 packet count(c2s)      : 4         layer7 packet count(s2c)      : 2         vsys                          : vsys1         application                   : Jumbomail         rule                          : rule1         session to be logged at end   : True         session in session ager       : True         session synced from HA peer   : False         layer7 processing             : completed         URL filtering enabled         : True         URL category                  : any         session via syn-cookies       : False         session terminated on host    : False         session traverses tunnel      : False         captive portal session        : False         ingress interface             : ethernet1/2         egress interface              : ethernet1/1         session QoS rule              : N/A (class 4)         session tracker stage l7proc  : fastpath state none admin@PA-500> ------------------------------------------------------------------------------------------- why is the output as follow: URL filtering enabled         : True thanks dor ... View more

Hey we have a setup that the client have 3 diffrent type of users connecting with global protect, and all need different configuration as i see it the only way is to configure 3 different portal for each user type am i right?     ... View more

hey we have a situation the loggen in users are sent to the captive portal. event a few minutes or an hour after they have logged in to the conuter. 1) when this is happaning then the ip-user mapping shows no user for the IP 2) we cant simulate this behaviour 3) we played arround with the ip-port mapping timeouts 4) client probing is turned on and we verified that the PA user can see the logged in user user wmi 5) we dont have problems in recognizing ip-user mapping in the environment 7) we user agentless userID 😎 we user 5.0.5 pa 500 questions 1) do you have any idea what may cause this? 2) how can i turn on debugs on the userID and captive portal so i can see why the PA drop/doesnt have the user-ip mapping when this will occure again 3) if the IP is not recognized by pa that a user is logged in to it from the AD security log for some reason, why doesnt it use the client probing for checking the logged in user? will appriciate any help for solving this issue until i will open a case thanks dor ... View more