About networkadmin

I upgraded our PAN from 4.1.x to 5.0.10 and also upgraded the User-ID agent from 3.x to the latest 5.x. We have some rules configured with groups specified and we have captive portal in place and what used to happen was if you came along on a domain joined laptop but were logged on as a local account (so LAPTOPNAME\LocalAccount) you'd get the portal and would have to authenticate using a domain account (standard Kerberos auth against the DCs). What's happening now is that the request is blocked because it's hitting the last whitelist rule which blocks all URL Categories other than the allow whitelist. The block page is showing the user as LAPTOPNAME\LocalAccount so the firewall must be picking up the local logon name from the User-ID agent - looking at the mapping list on the User-ID agent on the DCs confirms this. So I'm assuming we don't get the captive portal because the user is always known so the portal never needs to kick in? How can I make it so that the firewall won't see any usernames other than DOMAIN\Username from the User-ID agent please, so that in the situation above the portal would kick in like it used to? I've looked everywhere I can think of and I'm drawing a blank. ... View more

We had a strange issue today. We had a network outage which basically meant that all our DCs that run the User-ID agent were still running, and our PAN was still running, but there was no LAN between the DCs and the management interface on the PAN. The outage was several hours (it's been a "fun" day). Once the network was back, nobody could get to the internet, and upon looking in the PAN web gui all of the user-ID agents showed an orange light.  Doing a refresh did nothing.  Doing a "show" from the CLI simply returned "no configuration". Captive Portal didn't work either - you'd enter credentials and it would appear to authenticate but you wouldn't have internet access - this is usually our last resort because the User-ID agent lookup should work. The quickest option seemed to be to reboot the box, which we did, and everything reconnected - we didn't touch the User-ID Agent Service on the Domain Controllers. Our tech support logs are with our support, but any ideas what might have caused this please as I believed the User-ID service on the PAN should reconnect automatically with no user intervention? I'm a little concerned because it seems it wouldn't have mattered how many User-ID agents we had running for redundancy if the PAN wouldn't reconnect to any of them when the LAN came back. 5.0.10 ... View more

We have a PA-500 running 4.1.11. I wouldn't say we do anything special, it has some certs installed for forward and reverse SSL decryption, we do dynamic URL filtering and probably have something like 30 security policies in place on it and at any given time in terms of admin nobody is doing anything. Commit times seem insane.  I don't think I've ever had a commit happen in less than 5 minutes and on Friday I did a commit having added a URL to a URL Category and it took 20 minutes to do the commit. Is there any way of checking just why it would take so long?  It's always been my biggest issue with Palo Alto. Our supplier said some of their customers had found the memory upgrade made a difference but it isn't a cheap option and I'd like to understand exactly what increasing the memory improves in terms of performance. I am planning on upgrading to the latest 5.x release in the next week or so if that is likely to improve things. Thanks ... View more

We currently use our PAN in quite a dumb way where most internet access for end users is controlled by a single rule at the top of our rule set which simply allows https/https as outbound services, we don't block/allow specific applications but we do block by URL category and we do monitor using app-id. Could I please get a little feedback on how to effectively block users from downloading software from the internet (typical .exe and .msi installer files) whilst not disturbing all the "background" downloads that things such as a manual trip to Windows Update would result in please? We've found that we can get so far by having an override page on shareware/freeware by URL category but a lot of sites, often the vendors own site, slip through the net so we're not sure we have too many options other than to block on .exe/msi - and even then we only seem to be able to block or continue rather than override with a password. Thanks in advance. ... View more

Are there any known issues to be aware of if I wanted to go from 4.0.9 to 4.1.6? We had an issue when we went from 4.0.9 to 4.0.11 where the dataplane on our PA-500 randomly rebooted several times and support's initial suggestion was to do a factory reset/restore of the box. I'd prefer not to do that if it's avoidable, so I figure there should be no harm in seeing if moving 4.1.6 fixes it. It doesn't help that Palo Alto don't exactly make it clear when and why you should move to a new version of PAN OS.... I'm assuming the two main issues to address are the PAN Agent and that there's a half hour to an hour window of unavailability during the reboot and upgrade, but other than that... Thanks. ... View more