About apasupulati

Following docs explains how to enable it and how it works. https://live.paloaltonetworks.com/docs/DOC-1128 https://live.paloaltonetworks.com/docs/DOC-4882 . Hope this helps. Thanks Numan ... View more

Traffic and threat syslog will not come until you configure from security rule.Just remove forwarding from rules. ... View more

Depends on how they log on. Does the user have full access permission to the 2nd mailbox ? If so, you can make everything work with the same credentials. Or does the 2nd mailbox actually require logging on to it ? If so, you again have a logon event that will be picked up by UserID. In a AD environment, using different logins to different resources, is not really best practice for me. Give a user one account and make sure he can access whatever resource he needs with that account. You shouln't bother your users with several logins. Obviously this doesn't apply to users who do administrative tasks, where the admin account should be strictly separate from their everyday user account. I hope you get it sorted out... ... View more

I dont have LDAP Proxy enabled. telindus@fw1orgt(active)> show user group-mapping state all Group Mapping(vsys1, type: other): UIA         Bind DN    : cn=explotacio,ou=Noestandard,ou=ORGTusers,dc=orgt,dc=ad,dc=diba,dc=es         Base       : dc=orgt,dc=ad,dc=diba,dc=es         Group Filter: (None)         User Filter: (None)         Servers    : configured 3 servers                 10.1.1.8(636)                         Last Action Time: 599 secs ago(took 2 secs)                         Next Action Time: In 3001 secs                 10.1.1.249(636)                 10.1.1.16(636)         Number of Groups: 594 ----------------------------------------------------------------------- telindus@fw1orgt(active)> show user group-mapping statistics Name         Vsys    Groups Last-Action(secs)                Next-Action(secs) --------------------------------------------------------------------------- UIA          vsys1   594    627 secs ago(took 2 secs)        In 2973 secs telindus@fw1orgt(active)> show user group-mapping statistics Name         Vsys    Groups Last-Action(secs)                Next-Action(secs) --------------------------------------------------------------------------- UIA          vsys1   594    632 secs ago(took 2 secs)        In 2968 secs ... View more

I have seen capturing files after input this CLI command. Thanks. ... View more

Hi Aditi, Thank you very much. I solved the issue from your answer and It's a very cool feature for User-ID deployment Have a nice day! Thanks again. Regards, Roh ... View more

Hello, I've only seen this done through cli tools, using the filename in the URL does a GET request, instead you need to do a POST to submit data to the resource. Have you tried using curl or wget to import the file? example: curl --form file=@userdata.xml "http://<firewall>/api/?type=user-id&action=set&key=XXXXXX" Your response should be - <response status="success">   <msg>   <line>userdata.xml saved</line>   </msg> </response> FYI: there is a known bug on files could not be uploaded to the firewall using CURL with the XML API was fixed in 5.0.4. Refer to page 17 & 18 of the following article for the input file format: https://live.paloaltonetworks.com/docs/DOC-4126 Hope that helps! Aditi ... View more

Here is the correct call to modify the phash value of an administrator. http://<firewall>/api/?type=config&action=set&key=<key>&xpath=/config/mgt-config/users/entry[@name='username']&element=<phash>password</phash> Replace the <firewall>, <key>, username, and password attributes to appropriate values.  Once the call is made you should be able to see the changed value via the get API call but the change will not take effect until a commit is completed. You can also use an API call to generate the password hash. http://<firewall>/api/?type=op&cmd=<request><password-hash><username>user</username><password>password</password></password-hash></request> ... View more

Thanks again for the help. I just went ahead and created a second rule with a service using the ports 60000-65000 right after the policy I mentioned previously using web-browsing. My thought is traffic for 60000-65000 won't match the previous policy but will match the very next one which contains these ports. Seems like it's working! Thanks again! ... View more

Can someone clarify for me the setup for a "dynamic-ip-and-port" source nat on an active/active cluster?  The traffic for this particular rule must be source natted to a particular x.x.2.15 address when traversing through either device and should work when either member is down.  Please specify the A/A bindings required for the rule, and scenarios with and without floating IPs on the outside. Thank you. -Johnny ... View more

Was just having the same problem.  Turned out to be a return route as apasupulati suggested in item #3 of his post. Similar setup here in this post: Client VPN traffic and routing over IPsec Tunnel ... View more

I think I found what I am looking for. Clicking on the magnifying glass next to signature shows the release the signature was included in. This should work by comparing it to our current version. Thanks a ton! ... View more

You are afraid about split brain. use backup for management with selecting Heartbeat backup. I already did what you want to do without preemptive option.just manually flap, powered off the main device.After powering on manually switched the devices again. ... View more