About SOC_CSG

Hello The problem is the mail sender and the name of  attached file within changes, this happened several weeks ago and I created a rule tu deny the source, but now the source is different and also the file name. So data-filtering to deny incoming zip files with the regex "invoice.zip" won't be usefull in the future, and redirect the web page to a honeypot or sinkhole has the same problem, it changes in time. I read the post from Slawek and could be usefull. I will kept you inform. best regards Gonzalo ... View more

which license is necessary to use FILE BLOCKING??? we have only URL FILTERING and THREAT PREVENTION licenses. ... View more

we have only URL filtering license. We have updated the virus/threats signatures. We have thought add in block list (URL filtering profile) this line */invoce.zip it would work? ... View more

this is the log useridd Nov 19 17:10:09 pan_user_id_agent_update_unknown_ip_rate_limit: Unknown IP rate is now 101, enabling rate limiting for UID New Nov 19 17:10:10 pan_user_id_agent_update_unknown_ip_rate_limit: Unknown IP rate rate is now 100, disable rate limiting for Servidor wn12 Nov 19 17:10:10 pan_user_id_agent_update_unknown_ip_rate_limit: Unknown IP rate rate is now 100, disable rate limiting for UID Nov 19 17:10:10 pan_user_id_agent_update_unknown_ip_rate_limit: Unknown IP rate rate is now 100, disable rate limiting for UID New Nov 19 17:10:10 pan_user_id_agent_update_unknown_ip_rate_limit: Unknown IP rate is now 101, enabling rate limiting for Servidor wn12 Nov 19 17:10:10 pan_user_id_agent_update_unknown_ip_rate_limit: Unknown IP rate is now 101, enabling rate limiting for UID Nov 19 17:10:10 pan_user_id_agent_update_unknown_ip_rate_limit: Unknown IP rate is now 101, enabling rate limiting for UID New Nov 19 17:10:18 pan_user_id_agent_update_unknown_ip_rate_limit: Unknown IP rate rate is now 89, disable rate limiting for Servidor wn12 Nov 19 17:10:18 pan_user_id_agent_update_unknown_ip_rate_limit: Unknown IP rate rate is now 89, disable rate limiting for UID Nov 19 17:10:18 pan_user_id_agent_update_unknown_ip_rate_limit: Unknown IP rate rate is now 89, disable rate limiting for UID New ... View more

if i run ip-user-mapping, it doesnt work the matching but if i run user ip-user-mapping-mp its working. But in monitor traffic log i cant see any match telindus@fw2orgt(active)> show user ip-user-mapping all IP              Vsys   From    User                             IdleTimeout(s) MaxTimeout(s) --------------- ------ ------- -------------------------------- -------------- ------------- Total: 0 users --------------------- telindus@fw2orgt(active)> show user ip-user-mapping-mp all IP              Vsys   From    User                             Timeout (sec) --------------- ------ ------- -------------------------------- ---------------- 10.5.7.25       vsys1  UIA     oalgt\sanchetm                   2973 10.1.192.77     vsys1  UIA     oalgt\roureana                   2974 10.5.4.117      vsys1  UIA     oalgt\sanchegl                   2975 10.1.231.52     vsys1  UIA     oalgt\ferrergt                   2975 ... View more

PanOS is 5.0.8 ... View more

The problem is solved. Another Palo ALto mistery :S the PA had configured 4 servers in LDAP profile. One of those it wasnt LDAP 2 months ago so for this we had problem communications. We have delete this server in the LDAP profile and restart all the UserID Agent and now its working. Anyway, we have configured 3 more servers in LDAP profile, so i think this shouldnt happen because el PA would use anothe LDAP server, right???? ... View more

The connection between Palo Alto and the 3 UserID is ok but i think there is any problem with PA and DC..... ... View more

admin@fw1orgt(active)> show user user-id-agent state all Agent: Servidor wn12(vsys: vsys1) Host: 10.1.1.249(10.1.1.249):4444         Status                                            : conn:idle         Version                                           : 0x5         num of connection tried                           : 6547         num of connection succeeded                       : 6533         num of connection failed                          : 14         num of status msgs rcvd                           : 174769         num of request of status msgs sent                : 251164         num of request of ip mapping msgs sent            : 124366         num of request of new ip mapping msgs sent        : 0         num of request of all ip mapping msgs sent        : 6618         num of user ip mapping msgs rcvd                  : 413334         num of ip msgs rcvd but failed to proc            : 0         num of user ip mapping add entries rcvd           : 3879296         num of user ip mapping del entries rcvd           : 0         num of request of group msgs sent                 : 0         num of group msgs rcvd                            : 0         num of group msgs recvd buf fail to proc          : 0         num of xml data msgs rcvd                         : 0         num of xml data msgs rcvd but failed to proc      : 0         Last heard(seconds ago)                           : 0         Messages State:           Job ID                                          : 0           Sent messages                                   : 630481           Rcvd messages                                   : 1042673           Lost messages                                   : 63           Failed to send messages                         : 0           Queued sending msgs with priority 0             : 0           Queued sending msgs with priority 1             : 0           Queued rcvring msgs with priority 0             : 0           Queued rcvring msgs with priority 1             : 0 Agent: UID(vsys: vsys1) Host: 10.1.1.16(10.1.1.16):4444         Status                                            : conn:idle         Version                                           : 0x5         num of connection tried                           : 11115         num of connection succeeded                       : 11095         num of connection failed                          : 20         num of status msgs rcvd                           : 245573         num of request of status msgs sent                : 255851         num of request of ip mapping msgs sent            : 129492         num of request of new ip mapping msgs sent        : 0         num of request of all ip mapping msgs sent        : 1228         num of user ip mapping msgs rcvd                  : 540425         num of ip msgs rcvd but failed to proc            : 0         num of user ip mapping add entries rcvd           : 3723839         num of user ip mapping del entries rcvd           : 0         num of request of group msgs sent                 : 0         num of group msgs rcvd                            : 0         num of group msgs recvd buf fail to proc          : 0         num of xml data msgs rcvd                         : 0         num of xml data msgs rcvd but failed to proc      : 0         Last heard(seconds ago)                           : 0         Messages State:           Job ID                                          : 0           Sent messages                                   : 629466           Rcvd messages                                   : 882366           Lost messages                                   : 45           Failed to send messages                         : 0           Queued sending msgs with priority 0             : 0           Queued sending msgs with priority 1             : 0           Queued rcvring msgs with priority 0             : 0           Queued rcvring msgs with priority 1             : 0 Agent: UID New(vsys: vsys1) Host: 10.1.1.18(10.1.1.18):4444         Status                                            : conn:idle         Version                                           : 0x5         num of connection tried                           : 1130         num of connection succeeded                       : 1127         num of connection failed                          : 3         num of status msgs rcvd                           : 243407         num of request of status msgs sent                : 255701         num of request of ip mapping msgs sent            : 129321         num of request of new ip mapping msgs sent        : 0         num of request of all ip mapping msgs sent        : 1392         num of user ip mapping msgs rcvd                  : 545414         num of ip msgs rcvd but failed to proc            : 0         num of user ip mapping add entries rcvd           : 3737418         num of user ip mapping del entries rcvd           : 0         num of request of group msgs sent                 : 0         num of group msgs rcvd                            : 0         num of group msgs recvd buf fail to proc          : 0         num of xml data msgs rcvd                         : 0         num of xml data msgs rcvd but failed to proc      : 0         Last heard(seconds ago)                           : 0         Messages State:           Job ID                                          : 0           Sent messages                                   : 629472           Rcvd messages                                   : 1232203           Lost messages                                   : 102           Failed to send messages                         : 0           Queued sending msgs with priority 0             : 0           Queued sending msgs with priority 1             : 0           Queued rcvring msgs with priority 0             : 0           Queued rcvring msgs with priority 1             : 0 ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- admin@fw1orgt(active)> show user user-id-service status User ID service info:         User id service:               down         Reason:                        user_id service is not enabled admin@fw1orgt(active)> ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- admin@fw1orgt(active)> show user group-mapping state all Group Mapping(vsys1, type: active-directory): UIA         Bind DN    : cn=explotacio,ou=Noestaard,ou=OTusrs,dc=orgt,dc=ad,dc=da,dc=es         Base       : DC=orgt,DC=ad,DC=diba,DC=es         Group Filter: (None)         User Filter: (None)         Servers    : configured 3 servers                 10.1.1.8(636)                 10.1.1.249(636)                         Last Action Time: 1466 secs ago(took 31 secs)                         Next Action Time: In 2134 secs                 10.1.1.16(636)         Number of Groups: 615         cn=rrhh,ou=orgtgroups,dc=orgt,dc=ad,dc=diba,dc=es         cn=orgt.grars,ou=bus,ou=oau=distribution lists,dc=orgt,dc=ad,dc=da,dc=es -----------------------------------------------------------------------------------------         cn=aplicextern,ou=users,ou=orgtcitrix,dc=orgt,dc=ad,dc=diba,dc=es         cn=244_castelldefels_sg,ou=orgtgroups,dc=orgt,dc=ad,dc=diba,dc=es         cn=domain admins,cn=users,dc=orgt,dc=ad,dc=diba,dc=es         cn=orgt.elprat.fax,ou=busties,ou=oalgt,ou=distribution lists,dc=orgt,dc=ad,dc=diba,dc=es ... View more