About Remo

The other possibility would be if you extract the user information you need from syslog messages which you could send directly to the firewall. Or if you don't want to send syslog directly to the firewall or you do not want to allow connections to the Firewall API you could use the user-id-agent as kind of a proxy. This agent does also provide the User-ID XML API and the syslog receiver feature. After that you could configure this agent on the firewall and the firewall will get all the required information from this agent(s). With the script: there I made some tests with a powershell script which parses a log file continuously and puts the information onto the firewall over the xml api. ... View more

As far as I know (@community: correct me if I am wrong), your report with the top 20 visited sites will not be possible out of the box. This is because in the url field of the logs you have the full url. So for example for every search on google of a user you have a different url log entrywith different url's. To make this report usable you have to extract only the FQDN from the log and create the report with this data. This could be done for example with splunk.   For the other report with the spent time on a website it's kind of the same. To create this, you need to link the url log entry with the session start and end entries from the traffic log. But even then the report will not produce reliable output, because the session in the browser of a user could remain open even the user is not looking at the website anymore and is now doing something else on his computer. ... View more

Hi Christian (chrimie ) A little late but now I finally got what you meant with the password change behaviour. I was able to reproduce the issue (I tested with GPA 2.3.1) You mentionned that you opened a case for this: Do you have any results from that? Regards, Remo ... View more

like this, yes. this way you can now create zone based firewallrules and they would be the same for both asa. Now depending on if there is traffic needed between the interfaces of the asa (in order to make HA on them work), you also have to allow this traffic i think. ... View more

With a layer 2 switch there both possibilities would work. I would still reccommend to use the pa500 as layer 3 device between the asa's and the external network. But this is only my personal opinion because I like to have the control over the traffic flow by routing rather than traffic passing transparently (for the asa point of view) to the next router. ... View more

In this case I think connecting the asa's to two layer 2 interfaces would be the best solution.and then between the pa500 and the router a layer3 interface. so then you could configure both layer two links in the same (trust)-zone and the untrust one for the external link to the router ... View more

External Connection to a router or a first a switch and then the next router? ... View more

Depending on the requirements on the network after your pa500, you could use v-wires for both asa's or connect them to two layer two interfaces and create a corresponting vlan interface. ... View more

I think Palo creates his own login credential provider. So you have to make sure that you use the Global Protect login credential provider in order to make SSO work. On this picture you should see what I mean: ... View more

Depends on what login credential provider you used for logging in. This problem I had also  that it didnt pass the credentials even I had SSO configured ... View more

Does a GP Login window show up after you are logged in completely? Did you configre the client config in the portal configuration to use SSO for this particular user or only for the pre-logon user? ... View more

Hi sross79 First I have some questions: What OS are you using? What version of GP Client do you have installed? Are you able to ping the computer over the VPN connection during the whole loginprocess? Is it possible to map the drive of the computer while it is connected and no user is logged in? (I assume this is working when you log in with this particular user while the computer is located in your corporate network?) Do you also checked the thead log for blocked connections? Do you habe this error messages before or after the userlogin? What you also could try if the connection is there without any deny entries in the log is decreasing the MTU size on the computer where you have installed GP. Regards, Remo ... View more

Hi nthen Actually if you want wo use single sign on the users have to click the GP icon on the login screen. Without doing that the GP client does not get the usercredentials and cannot pass them directly to the firewall for the vpn login. If the users do not click the icon a GP login window should pop up where users have to fill in username and password. In windows 7 Global Protect was doing the same in default configuration, it created his own login credential provider. But there it was possible wrap an existing credential provider so only the user appeared only once on the login screen. But with windows 8(.1) (correct me if I am wrong, because I am also searching a possiblity to do that), this isn't possible anymore because Microsoft totally changed the login process with the credential providers. Regards, Remo ... View more