About sspringer

It may be that you are not in the correct vsys context. To switch vsys context in CLI run the following: > set system setting target-vsys <vsys> Once set, the CLI prompt should show the vsys your context is set. Hope that helps. - Stefan ... View more

If this is 4.1 and group mapping is setup on the firewall then please check the LDAP server profile configuration. The domain should be set to the netbios domain name that will get pre-appended to usernames. I have not seen any cases where this has stopped working with correct configuration. If the correct configuration is in place and the firewall is not storing domain with username please file a case with your support team so we can further investigate. ... View more

Hello, You can check the MP resources with 'show system resources follow'. If the MP is heavy into swap that could cause some problems, there are many memory leak fixes included in 4.1.7. Also you can check to see if any core files exist on the device 'show system files'. I would recommend generating a tech support file and opening a case with your support team, provide the time frame that the portal was unstable so historical logs can be reviewed from this time. - Stefan ... View more

Is WMI or NetBIOS probing enabled? Here is excerpt from User Identification Tech Note: https://live.paloaltonetworks.com/docs/DOC-3120 "If the probe succeeds and then subsequently fails for the same host, the IP will be re-classified as unknown." If enabled, you may want to disable for testing. It doesn't sound like a timeout issue, but you can enable 'Open Server Sessions' to see if that helps the problem. - Stefan ... View more

These are strange errors. Has this worked in the past or is it a new configuration? If it has worked in the past, I would start checking health of the device - for example maybe disk space is low or out of memory > show system disk-space > show system resources - Stefan ... View more

There are a few things I can think of that may cause issue. 1) Internal host / Router do not have route back to GP network - This will depend on your topology. It should work if the hosts have default route pointing to PAN. If there are router's between then check routing table for GP network. 2) Is GP in a separate zone than the LAN? - Verify security rule allows the traffic 3) Is this multi VR environment? - Need to verify next VR route 4) GP traffic sent internal is matching unintended NAT rule - Easiest to view traffic log for session details. You can see more detail via CLI 'show session id <id number>' If the problem is not obvious, you can post session information here or open a case with your support team for further troubleshooting. - Stefan ... View more

In the Bind DN example, a user named 'ldap' has been created inside of the 'CN=users,DC=plano2003,DC=com' container. Another example of this is if you were to use the built-in 'Administrator' account. The equivalent would be: CN=administator,CN=users,DC=plano2003,DC=com Please know, a more simple way to specifiy the Bind DN is set username@domain. Here are some examples showing two different DN formats that are equivalent. CN=paloalto,OU=firewalls,OU=network,DC=plano2003,DC=com paloalto@plano2003.com CN=ldap,CN=users,DC=plano2003,DC=com ldap@plano2003.com CN=administator,CN=users,DC=plano2003,DC=com administrator@plano2003.com Attached is example screenshot. - Stefan ... View more

The session does look correct. Also we can see there are no s2c packets: layer7 packet count(s2c)      : 0 I would refer to my previous post as it appears the PAN is not receiving SYN-ACK from the server - web server not receiving SYN (problem with PAN sending SYN out or device in between) - web server receiving SYN and not responding(problem with web server service/route/firewall) - web server receiving SYN and responding with SYN-ACK(need to check with pcaps if PAN is receiving SYN-ACK) - Stefan ... View more

Hi, Sometimes there are cases where large data transfers that are being scanned can cause high CPU. You can use ACC and 'Sort By: Bytes' to find the application pushing through the most data. If there is nothing obvious, I would recommend opening a case with your support team so we can take a deep dive through the resource monitor logs and other data. - Stefan ... View more

Hi David, You need to specify a service route based on destination for ldap connections. This can be done Device -> Setup -> Services -> Service Route Configuration -> set Destination(ldap server) and source Inside IP address - Stefan ... View more

Your configuration appears to be correct. The next steps would be to verify we are applying the NAT to the traffic and sending it to the server correctly. This can be done via CLI > show session all filter source <src ip address in testing> > show session id <id number> Here is an example output where 172.18.33.34 is my external testing client with 172.18.3.10 as my public IP and 172.24.53.55 as the internal address. Verify the correct s2c flow source address, rule, nat-rule, and ingress/egress interfaces. > show session all filter source 172.18.33.34 31313   web-browsing   ACTIVE  FLOW  ND   172.18.33.34[59092]/Untrust/6  (172.18.33.34[59092]) vsys1                                     172.18.3.10[80]/DMZ  (172.24.53.55[80]) > show session id 31313 Session           31313         c2s flow:               source:      172.18.33.34 [Untrust]               dst:         172.18.3.10               proto:       6 sport:       59092          dport:      80               state:       INIT            type:       FLOW                       s2c flow:               source:      172.24.53.55 [DMZ]           <--------- Internal Address     dst:         172.18.33.34               proto:       6               sport:       80              dport:      59092               state:       INIT            type:       FLOW start time                    : Tue Jun 12 11:47:07 2012       total byte count(c2s)         : 763       total byte count(s2c)         : 530       layer7 packet count(c2s)      : 6       layer7 packet count(s2c)      : 5       application                   : web-browsing       rule                          : web server        <------------ Security Rule  address/port translation      : source + destination       nat-rule                      : inbound web(vsys1)        ingress interface             : ethernet1/3       egress interface              : ethernet1/2.53 If the output looks correct then the following could be the case: - web server not receiving SYN (problem with PAN sending SYN out or device in between) - web server receiving SYN and not responding(problem with web server service/route/firewall) - web server receiving SYN and responding with SYN-ACK(need to check with pcaps if PAN is receiving SYN-ACK) To find which case is true you can enable pcaps on the PAN or on the web server itself. ... View more