About dpalani

As a test use a domain admin account, the first error message speaks of [lib/socket/interface.c:212:load_interfaces()] ERROR ===> To me it looks like its unable to open a socket for connection, restart the useridd agent should take of it since it would teardown and open new sockets. Please let me know if that helps. - Deepak ... View more

Hello, I believe you are seeing that because the app id change triggers the session to do a security policy look up. Though the session id remains the same the firewall will write a new log when you say log at session and the security policy look up is done due to application shift. I hope that explains the behavior you are seeing, also the option log at session start is recommended for troubleshooting purposes only. Enabling log at session start option will force the firewall to log the same session twice (Duplicate logs), logging is resource intensive process and can have significant performance degradation strictly based on number of rules where this option is enable and the number of sessions hitting those rules. Regards, Deepak ... View more

Hello Paul, Based on your explanation, it looks like a config migration issue. Following command will show if the firewall is connected to the user id agent "debug management-server conn", if the connection to the user id agent is seen, check for the stats with "show user user-id-agent statistics". If these two tests fail. Reconfigure the user id agent on the firewall. Regards, Deepak ... View more

Hello, Based on the behavior it looks like when the file is being transferred through ms-ds-smb the firewall does not detect it. This looks like an issue with ms-ds-smb decoder, please open up a case with support so that we can address this. Regards, Deepak ... View more

Which PAN-OS version are you running ? Are you seeing a similar issue if you were to use a different application as in FTP ? - Deepak ... View more

Agentless UID can connect to multiple AD's simultaneous, if the service account used by the agentless UID is valid do a WMI login on the respective AD's. - Deepak ... View more

Try adding the distinguished name of the group in the security policy, the firewall will identify the short name and populate it automatically with the correct group icon. Deepak ... View more

Do you have a decyption profile attached to the ssl decypt policy ? What have you configured for unsupported mode checks and failure checks. Set up a filter and run ssl counters to get more info. show counter global filter category ssl Deepak ... View more

The hostname is unique to each device so you can use a ignore list, the administrator name may be the same but, the domain the user name is in are different. ... View more

Is the proxy server able to establish a sip session successfully with the external server ? Is the proxy server a nat aware device( does it know its public ip address ) ? ... View more

Are the mappings (hostname/username) done for a single subnet or just a group of ip-addresses ? Depending on the ips you can use include/exclude list or ignore list. While using include exclude list you need mention the subnet's who mapping info you need and those you don't. If its random but same ips you can use the ignore list, which can configured the following way. How to Ignore Users in User-ID Agent ... View more