About Brandon_Wertz

I don't think it is an issue with having two portals. Both portals are set in the same template so they have identical configuration. DNS returns the IPs of both portals under the same hostname so they use the same certificate. I've tested this issue while initially connecting to each portal and the issue happens either way. ... View more

I can't speak to the "CSC" part of your question, but I can tell you the call out is specifically because your rule allows ANY application over ANY port. I'm not suggesting this rule as deployed in your organization is wrong for any particular reason.  This alert in the BPA report is suggesting that in a lot of use cases such a rule (any -- any) isn't suggested and should be restricted to defined applications over specific ports (Either app-default, or some other defined application.) ... View more

Hi PA support suggested to replace the cable they are sending replacement cable. Just for the people looking for answer to this issue. Thanks ... View more

Forget to mention that you need to do this in configure mode. So,  configure delete deviceconfig system ssl-tls-service-profile commit   ... View more

Thanks all.  I was able to get my issue resolved.  For some reason, my brain was unable to process the big "ACTIVATE" bar below.  Maybe it was too obvious 🙄 ... View more

@eberrocal, Just want to really back up what @Brandon_Wertz's already mentioned; these logs are not a good a good indicator of anything without heavy analysis which you wouldn't get in a report. Modern browsers will also preload/prefetch content to the point where URL logs directly are not declarative of someone ever visiting the resource in question.  ... View more

Thank you very much Brandon 🙂 ... View more

@JamshedDayar wrote: Hi Brandon,   Let me clarify.   Currently we have UIA version 8 on our 2012 server which is working fine since ages, status on that for all DCs is connected. no issues   Now we are deploying a win 2019 server with newer version of UIA 10.2 but using the same service account thats being already used for 2012 deployment ( so permissions are not an issue imo as that one is working fine )   Now on the 2019 server, the UIA agent is running and connected, but on 3 DCs ( screenshot attached in 1st post ) , the status is stuck at connecting and after sometime it is Connecting ( Access is denied ).    We have followed the KB and all local permissions are also granted to service account on new server as well.  Hrmm...If you're saying you've followed all the steps and the service account is running the software, it's possible there could be some weird issue going on, but that likely will need a support case to truly discover.   That said my enviornment is a mix of 3200s, 3400s, and 5250s running 10.1.X and 10.2.X PAN-OS.  I've got 4 UIAs targeting 100+ DCs and 1 credential agent.  We're running UIA software version 10.1.0-21 and we don't have any issues monitoring 2019 DCs.  Maybe try downgrading the UIAs to 10.1?   Where Can I Install the User-ID Agent? https://docs.paloaltonetworks.com/compatibility-matrix/user-id-agent/where-can-i-install-the-user-id-agent#id8f750af3-799f-4546-8b9e-a44a23b5b5c0     Which Servers Can the User-ID Agent Monitor? https://docs.paloaltonetworks.com/compatibility-matrix/user-id-agent/which-servers-can-the-user-id-agent-monitor#id48730da4-e269-4a3b-aeae-ea577c5c04ea  ... View more

Thanks for the feedback. within each object I have built out more specific checks like client specifics on anti-malware (AV), that the device belongs to a domain, disc encryption checks, updates enabled etc... still testing some additional options. but multiple hp objects it is.. 😞 ... View more

@Adrian_Jensen, Just echoing what @Brandon_Wertz mentioned, but it's also the safer default setting that will work for everyone regardless of how they setup their device. It's often not the ideal configuration depending on your configuration, in fact I'd go as far as to say in most cases it isn't ideal, but it is the safest default option to set for everyone.  ... View more

There's nothing in the logs you've shared which will help provide a definitive reason.  You're more than likely going to need a support case to find the root cause.   There are a lot of platform stability issues with the 10.2 code, especially with the 3400 code base.  Not sure what code these 3420s are running but it's possible the HA reboot happened because of a known bug that's mitigated in a later release. ... View more

@Sanjay_Ramaiah wrote: Hi Team, Please let us know if there is an option to check the latency, BW for RN-SPN, SC-CAN and MU-SPN users? Regards, Sanjay S Looks like it might be a mix of Panorama logs and Strata Cloud Manager.   ( eventid eq 'gateway-tunnel-latency' ) for MU in Panorama and strata cloud manager which will see both your SC as well as MU statistics.  But for MU info you'll probably need ADEM.     ... View more

@GWynn wrote: Hello,   I cannot see the Review Policies or the Review Apps link on this page? It is simply not there? Ideas? Thoughts? Bug?   My guess is you might not have enough permissions?  Are you logged in as an admin/superuser? ... View more

@patriciar wrote: Hi Brandon - I'm looking at the audit logs available in Prisma Cloud Compute, under Manage -> View Logs.   As per documentation goes,  "Administrative activity audit trail All Prisma Cloud administrative activities are logged. Changes to any settings (including previous and new values), changes to any rules (create, modify, or delete), changes to the credentials (create,modify, or delete), and all logon activity (success and failure) are logged. For every event, both the user name and source IP are captured."   Many of the log entries exceed the limit 128KB, which results in a log entry stating that fact. Do you know of a way to make these logs clearer?   Thanks P Oh ok...My company doesn't use Prisma Cloud so I can't speak to running into this issue, but if there's a config audit limit and it's not even 1MB that seems really small. ... View more