About djr

HI, This is only theoretical for me as I don't use captive portal (yet) but I noticed a problem.  I am successfully authenticating pretty much all my users, but quite often I see a few flows at the start of a user session which doesn't have a user-id.  A few milliseconds later the user-id is populated, so I guess this is just down to a slight delay between the first packets hitting the firewall and the user-id coming up with an answer. This is no big deal but it made me think if I did have a captive portal to identify all unknown users, a domain-authenticated user would still find themselves presented with a captive portal login page if they fire off an HTTP request very early on in their session. Is this a known behaviour?  It seems like a bit of an issue to me.  I know my users would moan about it. Cheers David ... View more

Hi, I just found a bit of a weird problem with the User-ID on a 2008 server due to the windows firewall. I am using AD service polling and SYSLOG feeds for the User-ID but I couldn't get the syslog messages to be recognised.  I could see them hitting the server via wireshark and when I turned of f the Windows Firewall they started working so it was clear where the problem was. When I configured the Windows Firewall I selected the user ID service and allowed all ports and protocols to it (inbound rule).  This meant that the firewalls could connect to it and I confirmed that was working OK. The only way I could get the syslog messages through was to create another rule allowing UDP 514 through to any program/service. Looking up with netstat though, port UDP514 was owned by the UAService.exe process which was the same as port TCP 5007 so that seemed as if it ought to work with the initial rule. Can anyone shed any light on why that first rule didn't work and what the recommended windows firewall rules are? (I did a search and couldn't see any articles on this) Thanks ... View more

Hi,  I have an active/passive HA setup and have link state monitoring enabled on my data interfaces, but I notice I can't select the management port for this.  To my thinking, if I lose the management port I would want the cluster to fail over because it would no longer be able to log to Panorama, or to look up user IDs. How would you recommend doing this?  Is link path monitoring (using the management IP as the source) the only way? ... View more