About clyde.franklin

clyde.franklin · ‎05-12-2016

For screenshot below I do have the first option shows as "Success" but the other options do not ubder Audit features. Do I need on some of the the other options as well like audit lohon events?

clyde.franklin · ‎05-12-2016

Tried all these recommnedations and the User- Agent Monitor tab still I show only2 IPs which is the IP of the firewall and the IP of my actual PC. I still never see any user that are showing logged under cli comning in on the agent. I have pretty much read evey article that esist on PA and User -ID set to no avail. So Im going presume that my issue is maybe log rellated on server itself. Apprently Im suppose to see below type responses from Agent logs which I never do. 4768 (Authentication Ticket Granted) 4769 (Service Ticket Granted) 4770 (Ticket Granted Renewed) 4624 (Logon Success)

clyde.franklin · ‎05-06-2016

Is there a reason why with Agentless User-ID I still never see any logs in Monitor? As shown below it definitaely is working but traffice logs do not sohw user-ids. I have a any any policy and user-id box is checked on the zones. ANy ideas? I ahve agent on a 2012 server I do see in logs ia se failed to connecr to LDAP but def its working from output dmin@PALO-TIA-03P vsys4(active-primary)> show user ip-user-mapping-mp all IP Vsys From User Timeout (sec) --------------- ------ ------- -------------------------------- ---------------- 10.64.21.84 vsys4 UIA ad\rivea 880 10.1.97.119 vsys4 UIA ad\miche 611 10.64.19.66 vsys4 UIA ad\mclaugm 1215 10.64.42.65 vsys4 UIA ad\treeced 265 10.64.42.104 vsys4 UIA ad\kopitsc 1045 10.148.2.216 vsys4 UIA ad\mumphre 652 10.84.2.50 vsys4 UIA ad\bursono 981 10.64.46.156 vsys4 UIA ad\xueli 977

clyde.franklin · ‎04-20-2016

so i ended up using box.xom for my test and found out that the box.com freeware would not work as you would have actully purchase the $15/monthly upgrade as you account has to be tied to a organaztion (your email) once i did that I was able to see my test PII policy i built to look for 'taxpayer" come thru although Aperutre may take a few hours to make new api call to retreive but it did work... See below

clyde.franklin · ‎04-20-2016

HI, anyone out there use Aperture yet? I have trial license which I have setup and added polices. Now what is suppose to happen? I see it show me Im now monitoring Salesforce and box.com but as show below everyting is showing "0's after a week of running. Whats suppose to happen? Should I try to upload a file or something? I did try to upload a file to both adn nothing happens in Aperture.

clyde.franklin · ‎04-15-2016

Just to close loop in case anyone else runs into Issue. What can be done to rule out that a issue isnt related to Blue Coat Proxy (or any other proxy for that matter) Would be to view traffic logs and sort by destination country which will show you if you are hitting external website directy. In the event you never see external IP adress then you are hitting a proxy. Equally modifying the URL filter and check x-forwarded-for will not change behavior either as the proxy may not have it enabled or blocking untrusted certs. So to my knowledge no way to bypass inline Blue Coat with Palo Alto ----Unless someone has tried. This my reason for not getting CP page. I confirmed with TAC as well

clyde.franklin · ‎04-14-2016

Just FYI changing mode did not work eiter I will spend some more time playing with it

clyde.franklin · ‎04-14-2016

Thanks Kim I will change mode and retry

clyde.franklin · ‎04-14-2016

Why does below document advise we need a L3 interface for captive portal? We are running solely vwire and I still get on form when testing. I do have repsonse pages setup as well https://live.paloaltonetworks.com/t5/Configuration-Articles/Configuring-Captive-Portal-in-V-Wire-with-RADIUS-Authentication/ta-p/58143

clyde.franklin · ‎04-13-2016

found a workaround

clyde.franklin · ‎04-13-2016

Any sites other that eicar.org I can use to test SSL decrption and response page? Due to symantec on 2012 server cant test using that site. Any recommendations will help

clyde.franklin · ‎04-13-2016

Through research this is posssble with vwire

clyde.franklin · ‎04-13-2016

Hi all, before I head of and start configuring is it possible to test SSL Decrpyition in Vwire mode? I ahve a test server spun up in my lab and wanted to confirm

clyde.franklin · ‎04-12-2016

Disreagard fixed it

clyde.franklin · ‎04-12-2016

I have VWIRE setup rule is trust to untust (wide open rule to any) I added sinkhole profile to the rule. I also added a deny rule above for my sinkhole ip (53.53.53.53). I have my windows box pointing to .2.2.2 when I do nslookup on suspcisous site I never see it hit the sinkole policy nor does the 53.53.53.53 ip show up in threat or traffic logs. Can someone provide input why this happening? I have followed intrustions per document.

Member Since	‎03-18-2015 11:35 AM
Date Last Visited	‎12-21-2017 03:26 PM
Posts	123
Total Likes Received	5

Online Status	Offline
Date Last Visited	‎12-21-2017 03:26 PM

About clyde.franklin

Download Status 2017-05-02 13:43:30.545 -0700 URL database download: not available.

Re: Discerpency between Panorama and Acutal Devce

Discerpency between Panorama and Acutal Devce

Why is iDNS Proxy screen is blank when I click add it enabled by default how to disable v8.0.2

Warnings Message Disabled applications in shared:

Snmp agent log

Last SNMPv3 question

Low Forwarding 8.0 (7050)

Re: SNMPv3 Prfile import /export

SNMPv3 Prfile import /export

Any one work with RiverBed and PA intergration

Re: Slowness with http file transfer after placing PA in-line

Re: Slowness with http file transfer after placing PA in-line

Re: Flood protection

Re: Testing SSL Decryption (Cant use eicar.org due to symantec)

Re: Panorama

Re: Github Pan-configurator tool

Re: User-ID Agentless question

Re: User-ID Agentl question

User-ID Agentless question

Re: Aperture use

Aperture use

Re: Captive Portal with Vwire.

Re: Captive Portal with Vwire.

Re: Captive Portal with Vwire.

Captive Portal with Vwire.

Re: Testing SSL Decryption (Cant use eicar.org due to symantec)

Testing SSL Decryption (Cant use eicar.org due to symantec)

Re: SSL Intercept

SSL Intercept

Re: Sinkhole Clarification

Sinkhole Clarification

Unlock your full community experience!

About clyde.franklin