About bpappas

bpappas · ‎08-29-2011

@sunilsadanandan: In the first scenario you describe, we would most likely write a signature for the user-agent string. In the second scenario we could allow, alert or block the traffic to your web server at home based upon URL filtering. Since your server at your house would probably not be categorized by any URL filtering service it would probably match the "unknown" category. -Benjamin

bpappas · ‎08-29-2011

@sajens: as you point out this is most likely an issue with the AD server, but one last test you might run is to bind to LDAP with a username and password that do not contain any special characters (just to rule out this as a source of the issue). Once you have done that I would do a packet capture on the AD server to demonstrate to the AD admin that the packets are being sent and processed by the LDAP portion of AD. -Benjamin

bpappas · ‎08-29-2011

@acwsupport: The Palo Alto Networks devices do not currently have a CSR feature. You will need to create the CSR using an open source tool such as open-ssl. There is a document about this topic already on Knowledge Point. https://live.paloaltonetworks.com/docs/DOC-1246 -Benjamin

bpappas · ‎08-26-2011

Are you using static NAT or dynamic NAT? Does the Polycom use H.323? -Benjamin

bpappas · ‎08-26-2011

@Bhav: If you are logging on session end then you have to wait for the session to end before you will see it in the traffic, threat, URL or data filtering logs. if a session ends up in a hung state then it stands to reason that you would not see it in the logs yet. -Benjamin

bpappas · ‎08-26-2011

@lildeniz: the ignore list should not contain the domain prepend. the file should contain one user per line. for example: joe mary kral administrator

bpappas · ‎08-26-2011

@Iceman: I believe you are trying to push configurations to the managed devices. In this case, if you click on the "commit all failed" you should see a pop up window with a reason for the commit failure. -Benjamin

bpappas · ‎08-25-2011

@cmaier: these fields are for setting a maximum # of resources that can be used by each vsys. If these are left blank then the system will allocate resources as needed until you reach the max # of policies/tunnels/routes/etc allowed on the hardware platform that you are using. -Benjamin

bpappas · ‎08-25-2011

@KMacnaughton: What hardware platform are you using for this setup? -Benjamin

bpappas · ‎08-25-2011

@sbremmer: none = take no action which is equivalent to "allow" You will need to approach your configuration challenges slightly differently than you have outlined in your post. In most environments employees will be allowed to do more than students. With this in mind you could make sure that the URL profile for students is blocking the employee categories and that the URL profile for employees is allowing the student category. And if this seems overly cumbersome you can always talk to your sales team and submit a feature request with them to modify how the feature is implemented on the Palo Alto Networks products. -Benjamin

bpappas · ‎08-25-2011

@Bart.Jocque: The sum total of the vsys configurations cannot exceed the max # of policies/sessions/tunnels/routes/etc for the device. -Benjamin

bpappas · ‎08-25-2011

@cmaier: Your plan looks doable. If you do this I would recommend making L3 subinterfaces on the aggregate link. L2 / L3 setups can be more involved if things are not working properly and my experience suggests that keeping it simple and sticking with a full L3 setup would be the way to go. If you need design guidance you should work with your Sales Engineer to find the right solution for your environment. -Benjamin

bpappas · ‎08-25-2011

@kahmad: could we see a screenshot of the HA config screen from each member of the HA cluster? and also for the captive portal configuration of both devices? as always: obscure the IP addresses unless you are OK with others seeing your internal network information. -Benjamin

bpappas · ‎08-25-2011

@kahmad: I would suggest opening a case with support to find the root cause of this issue. -Benjamin

bpappas · ‎08-25-2011

This is just a shot in the dark, but are the GP clients able to check cert validity against the external CA before they are authorized on the network? -Benjamin

Member Since	‎08-23-2010 12:03 PM
Date Last Visited	‎05-29-2018 02:28 PM
Posts	430
Total Likes Received	91

Online Status	Offline
Date Last Visited	‎05-29-2018 02:28 PM

About bpappas

Re: Custom Signature for Dahua NVR

Re: Custom Signature for Dahua NVR

Re: Custom Signature for Dahua NVR

Re: zenmate application

Re: zenmate application

Re: Block Macro-enabled Word documents

Re: InfluxDB Application Traffic

Re: APPID signature for Zebra Printers showing unknown-tcp or insufficient data

Re: support NATO STANAG 4609

Re: APPID signature for Zebra Printers showing unknown-tcp or insufficient data

Re: Allowing the PAN to respond to tracert

Re: Havij SQL Injection Filter

Re: URL Category Action = None?

Re: IP to Username mapping problem

Re: APPID signature for Zebra Printers showing unknown-tcp or insufficient data

Re: Pokemon GO

Re: Signature for Clash of Clans game

Re: Base64 encoded HTTP traffic.

Re: AD/LDAP Server authentication

Re: Trusted Certificate with HA

Re: Connection Problem with Polycom VSX7000

Re: Session Browser?

Re: panagent user identification problem with working groups on the active directory

Re: Panorama SSL Decryption Rules

Re: Virtual System Settings - Recources

Re: Respond to ARP for path-monitor IP in virt-wire mode?

Re: URL Category Action = None?

Re: VSYS limitations

Re: Trunk / Link Agg Recommendation

Re: Captive Portal with Session Cookie - Synchronization problem

Re: Global Protect - Source User 127.0.0.1

Re: Global Protect Setup using an external CA

Unlock your full community experience!

About bpappas