About dthibodeaux

dthibodeaux · ‎04-08-2015

From my customer: "Yesterday, I was able to run an activity report on a user from the Palo Alto on my desktop. When I went over to show a colleague how to run the reports, the same exact report come up blank. We tried logged in as her and as admin from her computer. We also tried using Chrome instead of IE on her computer. I was using IE." Do you know why the results of running the report on her desktop versus mine would give different results? Could java be the culprit? Thanks David

dthibodeaux · ‎02-11-2015

@emr-the box has not been up that long. Thanks @Quinton- not sure on the session monitoring..I will check. Will also check WMI probing. How would I know if it is working or not?? These are actually wireless users, if that matters. Thanks!

dthibodeaux · ‎02-03-2015

haven't opened a case yet...we may try to upgrade to at least 6.0.7 and see if that helps. The agent is installed on one server.

dthibodeaux · ‎02-03-2015

Found an issue on a customer's firewall. For some reason, the “source user” becomes unknown while students are using a web application called Istation. When that happens, the web traffic for that IP address becomes blocked by another policy. She wrote a specific policy for Istation traffic even if the user is unknown to resolve this issue. But the real question is….Why is the “source user” blanking out in the middle of using a web application? Appreciate your thoughts and suggestions. Thanks

dthibodeaux · ‎11-11-2014

Is there a way to whitelist some URLs that would be allowed without or before authentication via Captive Portal? What we are wanting to do is allow users to access email via Office365 without having to authenticate first on the captive portal. This is all via wireless of course. I tried adding a rule at the top of the security polices before the captive portal rule, but it stopped browsing all together. Thanks!

dthibodeaux · ‎10-22-2014

how are application and service treated in a given policy? multiple apps in a policy? multiple services in a policy? apps and services in a policy? how are the different scenarios and'ed or or'ed? Thanks David

dthibodeaux · ‎10-10-2014

ok I got it working using the UID agent residing on the DC. Thanks for all the info!!

dthibodeaux · ‎10-08-2014

I did finally get this to work using the user-id agent setup on the PA itself but my concern is how taxing this might be to the box in a production environment. I would really like it to work using the user-id agent on the domain controller. For some reason I cannot get the info from the DC to the PA for the wireless users. I have the Aruba pointing at the DC where the agent resides, I have the agent setup with the sender info but never see the user info on the PA in the monitor logs. any ideas?

dthibodeaux · ‎10-08-2014

ok so this customer does not have clear pass so I am assuming the xml api solution wont work...as far as the syslog solution, I am trying to set this up in my lab. I have a aruba controller, pa200, and 2008 server. Do I run the syslog server on the same server as the user-id agent is on or do these need to be separate boxes? I am running kiwi syslog server on the same 2008 server as the UID agent is on...think I said that already The document keeps referring to a "syslog sender" and I am not sure if that is the controller, the PA, or the 2008 server. Thanks David

dthibodeaux · ‎10-06-2014

I'm guessing I'm not...:smileyconfused:

dthibodeaux · ‎10-06-2014

ok so some more info This is only happening on wireless users....wired works fine. we are not seeing a user/ip mapping for the wireless users...the source user is blank Is there some new feature in 6.0 to help with this?

dthibodeaux · ‎10-06-2014

currently have a customer using radius authentication on the wireless and user-id on the PA. The problem is when two different users use the same machine. Teacher logs in and gets a policy applied to the session going through the firewall and she logs out and a student logs in to the same machine, that student has the same privileges through the PA as the teacher did. It seems like the PA is not releasing the session and applying the correct policy to the new user. Any ideas? setup is HA-3020's and Aruba wireless. Radius auth is against microsoft 2012 server Thanks!

Member Since	‎09-16-2011 01:07 PM
Date Last Visited	‎09-29-2015 01:38 PM
Posts	12
Total Likes Received	2

Online Status	Offline
Date Last Visited	‎09-29-2015 01:38 PM

About dthibodeaux

User activity report is blank on different computer but fine on others

Re: source user showing as unknown in traffic monitor

Re: source user showing as unknown in traffic monitor

source user showing as unknown in traffic monitor

white list and captive portal

security policies: application vs service

Re: multiple users same machine privileges crossed

Re: multiple users same machine privileges crossed

Re: multiple users same machine privileges crossed

Re: multiple users same machine privileges crossed

Re: multiple users same machine privileges crossed

Re: multiple users same machine privileges crossed

User activity report is blank on different computer but fine on others

Re: source user showing as unknown in traffic monitor

Re: source user showing as unknown in traffic monitor

source user showing as unknown in traffic monitor

white list and captive portal

security policies: application vs service

Re: multiple users same machine privileges crossed

Re: multiple users same machine privileges crossed

Re: multiple users same machine privileges crossed

Re: multiple users same machine privileges crossed

Re: multiple users same machine privileges crossed

multiple users same machine privileges crossed

Unlock your full community experience!

About dthibodeaux