About ialeksov

Hi Rich, Check these two links out: This works perfectly and I have configured it on multiple occasions for customers that like to use WLC's to get the mappings to the firewalls. How to Collect the User-IP Mappings from a Syslog Sender Using an User-ID Agent How to Configure a Custom Syslog Sender and Test User Mappings I hope this helps you. ... View more

Hi dieterb, The only way that you might be able to accomplish this is to use a decrypt certificate that is issued by a trusted root CA. This is the only option since you do not have the ability to push the cert yourself to the devices, since you do not control them. Using an untrusted certificate looks bad and will prompt the users every time they visit a site to accept the "risk" since their traffic is being "men in the middled" by a device that was cert from an unknown CA. You can pay a couple of 100$ and get a cert and have no worries about this at all. Most of the customer I have seen prefer this solution. I hope this helps you. BR ... View more

Hi Jean, Even if there is way how to do a bulk check of URL, there is a way how to request a bulk re-categorization. You might find this helpful in one point if you are doing this checks. Here is the link where you can do this: Palo Alto Networks URL Filtering - Bulk Change Request ... View more

Try using WMI probing as one of the most correct methods, but bear in mind to limit the scope of probing to the local network, because you probably dont want to send wmi probes from usa to europe for each unknown user. Also one other thing you can do is to include the exchange in the monitored servers. As far as it goes for aruba, check these docs which show you how to get the logs directly to the syslog receiver that can be run on the PA or on the user-id server: -How to Collect the User-IP Mappings from a Syslog Sender Using an User-ID Agent -How to Configure a Custom Syslog Sender and Test User Mappings ... View more

Yes Mark, You can used it for the mac's too. If you like you can divide the checks for MAC and for Windows machines in separate IP Profiles, where one can be checking if the system has Windows OS, and an AV solution running (and/or up to date), and another HIP Profile that will check if the system is MAC OS and there is and an AV solution running (and/or up to date). For that reason when creating the HIP object, in the GENERAL tab, mark the Host info and select the OS as needed (mac or win), and if needed limit the versions that are in usage in your environment (maybe you are only using windows 7 Professional and windows 8.1 for the Microsoft OS and Mac OS X 10.8 from Apple). After that make the needed combination of HIP objects into HIP Profiles (using logical operators) and attache the profile to to a security rule. Dont forget to add block rule for the users that dont have the HIP profile, or at least limit them to just be able to go to certain sites (like the update server for the AV solution in use). ... View more

Hi Mark, You can use HIP checks to do this. You will need to configure HIP object for the AV solutions that you want the firewall to check for, than create a HIP profile and to assign the profile to a security rule (this is selected in the Users tab of the security policy). Please check this article. It is for widows patches, but the principle is the same. How to Configure HIP for Missing Microsoft Patches Hope this helps ... View more