About _slv_

Hello Some time ago I created url-filtering profile: Today I found in wildfire report that someone try to download something from malware site, so I try to check is my configuration works as expected. First of all I checked is it still a malware site: admin@PA-200> test url sunrisebrowse.net sunrisebrowse.net malware-sites (Base db) (I'm using BrightCloud URL Filtering) so I started browser and I try to open "sunrisebrowse.net" after 30s or more browser wos redirected to: "http://8.34.112.54:6080/php/urlblock.php?vsys=1&cat=10056&title=malware-sites&rulename=Lan_A%20NAT%20-%20monitoring&uid=45&url=http://sunrisebrowse.net%2f" and timeout was displayed in browser. I expected responce page insted of timeout... I found the session: 61542    undecided  ACTIVE  FLOW  ND   192.168.1.35[59936]/Lan_A/6  (192.168.1.35[59936]) vsys1                                      8.34.112.54[6080]/captive-portal  (127.131.1.1[6180]) admin@PA-200> show session id 61542 Session           61542         c2s flow:                 source:      192.168.1.35 [Lan_A]                 dst:         8.34.112.54                 proto:       6                 sport:       59936           dport:      6080                 state:       INIT            type:       FLOW                 src user:    unknown                 dst user:    unknown         s2c flow:                 source:      127.131.1.1 [captive-portal]                 dst:         192.168.1.35                 proto:       6                 sport:       6180            dport:      59936                 state:       INIT            type:       FLOW                 src user:    unknown                 dst user:    unknown                 qos node:    ethernet1/4.1, qos member  Qid 0                 match src interface:  any                 match src address:    ('any                  ',)         start time                           : Mon Dec  8 11:26:16 2014         timeout                              : 30 sec         total byte count(c2s)                : 206         total byte count(s2c)                : 0         layer7 packet count(c2s)             : 3         layer7 packet count(s2c)             : 0         vsys                                 : vsys1         application                          : incomplete         rule                                 : captive-portal         session to be logged at end          : False         session in session ager              : False         session updated by HA peer           : False         address/port translation             : destination         nat-rule                             : NAT_Lan_A(vsys1)         layer7 processing                    : enabled         URL filtering enabled                : False         session via prediction               : True         use parent's policy                  : False         session via syn-cookies              : False         session terminated on host           : True         session traverses tunnel             : False         captive portal session               : True         ingress interface                    : ethernet1/4.1         egress interface                     : ethernet1/1         session QoS rule                     : N/A (class 4)         end-reason                           : aged-out Ethernet interface for zone where is my workstation hasn't captiveportal option enabled. Why this session is "rule : captive-portal", similar config works perfecly for wiruses, ie. when I try to downloaad Eicar sample I get responce page with warning. What's wrong in my configuration? do I miss something? Regards SLawek ... View more

Hello I'd like to consult with You one problem. My users authenticate with Radius on Captive Portal web page. Problem that comes to me is how to assign access according to groups of users. My FreeRadius has only one group of users, I can add more but how to use it in PAN? I read How to Configure RADIUS Authentication and there is "Retrieve user groups" checkbox but after I enabled it and do commit I cant see my groups in ADD in Authenticate Profile tab. I know that I should use RADIUS Vendor Specific Attributes (VSA) PaloAlto-User-Group: Attribute #5 - This is the name of the group to be used in the Authentication Profile Do You know how to configure FreeRadius to use it? Please point me in right direction with this problem. Regards SLawek ... View more