About SoftwareMedia

Thanks for the tip! > show ssl-vpn current-user Does exactly what I am looking for, for currently logged in users. I am also very interested in getting that same view from the logs. It would allow me to audit VPN access very quickly. ... View more

Maybe I have something configured wrong. While that does produce an easy filter to see VPN users and their IP it shows the address the users has been assigned from the VPN Address pool (172.16.1.1/25) I am wanting to see the IP address of the machine that the user authenticated from. In System logs with Filter set to: (eventid eq sslvpn-regist-succ) it shows the IP address the user authenticated from: (SSL VPN user login succeeded. Login from:75.152.213.61, User name: USER.) I am trying to correlate 75.152.213.61 to 172.16.1.1 to USER in the traffic logs for a given date / time without having to jump back and forth from Traffic logs and System logs. Most of my VPN users login from a static or near static IP (IP changes once ever 3 months) for all my efforts to educate they are still very careless with their credential, leaving them on postit notes and the like for anyone to see. If I can easily correlate USER to the IP they authenticate from it makes it easier to determine if their credentials have been compromised. -Michael ... View more

Changed from 172.16.1.0/24 to 172.16.1.0/25. Solved all my problems. Thank you! Might consider modifying "How to Set Up and Configure SSL-VPN" doc @ https://live.paloaltonetworks.com/docs/DOC-1157 ... View more

Kelly, Thanks for the quick reply. Tunnel interface is in Zone: trust To access VPN I have it configured to be a loopback interface of our untrust interface. I did this because our mail server is currently mapped to HTTPS on .122 Untrust interface is .122 loop back interface for VPN is .124 both in Untrust zone. I setup a rule From: ANY To: ANY Source: VPN IP (172.16.1.0/24) From User: VPN Users Connect to VPN and then ping yahoo.com. Look at Traffic logs and see From: trust To: untrust Source 172.16.1.1 Destination: 209.191.93.53 User local:mauger Action: allow Rule: VPN Ingress I/F: tunnel Egress I/F eth 1/1 Ping one of the DNS servers I have configured in the SSL-VPN and look at Traffic logs I see From: trust To: trust Source 172.16.1.1 Destination: 192.168.1.60 User local:mauger Action: allow Rule: VPN Ingress I/F: tunnel Egress I/F eth 1/2 Ping any server that is on the internal network that isn't a configured DNS server in the SSL-VPN and the requests time out. I look at the traffic logs and see no traffic. I set the VPN rule to Deny all traffic to Trust and I can no longer talk to the two DNS servers, I check traffic logs and I can see it deny all traffic to the two DNS servers. Traffic to any other server on the internal network still doesn't show up in the logs. Not sure what I need to do. -Michael ... View more

wow, epic fail on my part. Thanks for pointing out that crazy obvious button that i for some reason never thought to click on. ... View more

I understand there is more detail as you drill down, but once I have removed all filters and am back at what should be the root ACC tab it has alot more detail than had I just clicked on the ACC tab. With how it is behaving now, the only way I have found to view details for a specific user is to click ACC tab, click web-browsing (which hopefully that users has done or they will not show up in the next view), then click on the source user and then remove the web-browsing filter. Is there a more direct way to add a 'Source User' filter? ... View more

Awwww.... that makes me sad. It is great to hear you are actively working on it. It is, without question, something that will be tricky to pull off. Gives me something to look forward to playing with though. It is features like this that really set Palo Alto apart from the competition. Keep up the great work! ... View more

It would be an amazingly helpful feature. Any ballpark ETA for when we might expect it to show up? ... View more