About OGMaverick

OGMaverick · ‎04-26-2019

Yes, you should be blocking QUIC as well as UDP 443. Blocking Quic will retransmit over TCP and let the applications be identified properly. This is what Palo recommends. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClarCAC

OGMaverick · ‎04-17-2019

Make sure to replace it with an object if possible instead of an address so you only have to change it in 1 place on the future!

OGMaverick · ‎04-10-2019

@Brandon_Wertz wrote: @Wasfi.Bounni wrote: Hi; What happens when you do switch user, does the integrated User Agent logoff the original user? Does the original entry in the user to IP mapping table get overwritten ? Kindly Wasfi Say user A logs into a machine with IP 1.1.1.1. Provided you are capturing the correct mapping criteria UIA will see user A tied to 1.1.1.1. That user locks their machine and user B comes to the same machine and "switches user". User B provides credentials and logs into this same machine with IP 1.1.1.1. Again, provided the authentication messages are being captured at this time the OLD record of user A being tied to 1.1.1.1 is removed and is replaced with user B as being associated with 1.1.1.1. However, if fast user switching is used again so B switches back to A, the logs will most likely continue seeing user B on that IP. This came up recently here and it doesn't appear that the Palo reads the proper events to keep track of FUS events. I beleive I read that other vendors solved this by reading 4778 & 4779

OGMaverick · ‎03-01-2019

Yes

OGMaverick · ‎02-28-2019

Auth profile is correct & the user with the computer hostname never shows in the traffic/url logs or in the CLI when I did a show user ip-user-mapping all. It's like the PCs are passing the hostname to the DCs as the username from time to time. Grabbed a small snippet of the user-ID logs to show what I'm talking about. When this happens, the user appears in traffic logs as user@domain.com until they reappear into user-id the correct way. Top 2 are normal and have the username. Second two are showing PC hostname. All from the same source. Would love to stop the bottom 2 from happening

OGMaverick · ‎02-26-2019

While looking through logs to see why occionally a user gets reported as user@domain.com instead of domain\user, we noticed the logs were filled with COMPUTERHOSTNAME@DOMAIN.COM as well. Is this expected?

OGMaverick · ‎01-31-2019

After searching a little more, is seems like MS did add in securty event IDs to show when logging in/out using Fast User Switching. 4778 & 4779 which some say solved the issue for their vendors. If PAN doesn't currently support reading those, that would be a nice addition. I will bring up the possibilty of disabling FUS with the team that would make that decision though, thank you.

OGMaverick · ‎01-31-2019

Is there a best practice for making the Palo able to realize who is currently actually logged onto the machine, or are we forced to disable Fast User Switching for this? (Windows 10) I know currently that if user A logs in, it knows it's A. If we switch user and B logs in, it then knows it's B. However if we switch user back to A, the logs can keep just reporting the user as B, as I believe the fast user switching doesn't fire off the necessary log for the palo to check?

OGMaverick · ‎01-11-2019

@LukeBullimore I believe that is the opposite of what we'd like to do. There are many many groups and users to be allowed and only a few we'd like denied from logging into captive portal, so a deny option would be best instead of an allow. @BPry We do currently have a security policy to deny all traffic if they are coming from the captive portal network + match one of the generic user accounts. We'd much rather prefer them not be able to log in with the user at all on the captive portal, as they would now have to wait 24 hours to be re-prompted for creds or have us manually flush them so they can log in with the proper accounts.

OGMaverick · ‎01-09-2019

That is what we'd like to do, but we only see the option to allow a group/accounts.

OGMaverick · ‎01-08-2019

I know there is the allow list, but what about an exclude? We use Captive Portal for BYOD and have thousands of accounts we want to allow, but exclude our double digit generic accounts from being able to log in. What's the best way to achieve this?

OGMaverick · ‎11-14-2018

Appreciate the update. We were seeing random complaints of safesearch blocks as well all from Chrome.

OGMaverick · ‎10-30-2018

We've been on 8.1.x since we got our boxes (5220) However, up until now we were only using userinput instead of modifying it so that users could log in with or without the domain. Primary username is userPrincipalName. The 8.1.4 upgrade & auth profile change were done at the same time.

OGMaverick · ‎10-30-2018

There were the following 2 changes: 8.1.2 > 8.1.4 Changed auth profile to include the modifier so users can log in as 'user' or 'user@ccboe.com'

OGMaverick · ‎10-30-2018

All of our users who auth over CP are now normalizing as 'domain.com\user' although we need them to be user@domain.com. The authentication profile they go through has the %USERINPUT%@%USERDOMAIN% modifier. Domain is filled in & login attribute is 'userPrincipalName'. All users who are gettng mapped through AD instead of CP are showing corrently as user@domain.com. We only have 1 auth profile, 1 ldap server profile, 1 group mapping settings profile.

Member Since	‎03-13-2018 02:08 PM
Date Last Visited	‎04-15-2024 10:33 AM
Posts	48
Total Likes Received	8

Online Status	Offline
Date Last Visited	‎04-15-2024 10:33 AM

About OGMaverick

Re: iOS Global Protect Always-On VPN ?

Apple TV / tvOS

Re: iOS Global Protect Always-On VPN ?

iOS Global Protect Always-On VPN ?

Re: PA3020 upgrade failure from 8.0.11-h1 to 8.1.9-h4 - FIPS failure error

Re: iPad Global Protect Auto Connect

Re: iPad Global Protect Auto Connect

Re: Allow techblog.netflix.com without allowing netflix-base?

iPad Global Protect Auto Connect

Re: SSL Outbound decryption - Outbound traffic

Re: UDP 443 becoming more prevelant

Re: UDP 443 becoming more prevelant

Re: Edit Security Policies simultaneously

Re: O365 sub-applications

Threat False Positives?

SSL Decryption with iOS 13 Devices

Re: URL logs without URL Filtering license

Re: Auth Profile 8.1.x LDAP

Re: Auth Profile 8.1.x LDAP

Re: Auth Profile 8.1.x LDAP

Re: UDP 443 becoming more prevelant

Re: Edit Security Policies simultaneously

Re: What happens when you do switch user, does the integrated User Agent logoff the original user?

Re: O365 sub-applications

Re: USER-ID littered with pc HOSTNAME@DOMAIN.COM

USER-ID littered with pc HOSTNAME@DOMAIN.COM

Re: User-ID & Fast User Switching?

User-ID & Fast User Switching?

Re: Exclude account(s) from authentication?

Re: Exclude account(s) from authentication?

Exclude account(s) from authentication?

Re: Block page when searching google with safesearch enabled

Re: 8.1.4 CP Normalizing

Re: 8.1.4 CP Normalizing

8.1.4 CP Normalizing

Unlock your full community experience!

About OGMaverick