This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About Kevin_Holleran
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About Kevin_Holleran
08-18-2015
11Posts
0Likes
0Solutions
Aug 18, 2015Last Visited
User
Activity
User
Profile
Latest posts by Kevin_Holleran
| Subject | Views | Posted |
|---|---|---|
| 2541 | 04-09-2013 06:29 AM | |
| 2540 | 04-09-2013 06:25 AM | |
| 2877 | 04-08-2013 01:05 PM | |
| 2153 | 03-15-2013 10:53 AM | |
| 2152 | 01-30-2013 09:19 AM | |
| 2465 | 01-30-2013 09:03 AM | |
| 1485 | 01-28-2013 10:58 AM | |
| 1539 | 01-28-2013 07:37 AM | |
| 3433 | 01-14-2013 12:22 PM | |
| 3433 | 01-14-2013 11:41 AM |
User Badges
Community Statistics
| Member Since | 01-07-2013 12:02 PM |
| Date Last Visited | 08-18-2015 09:07 AM |
| Posts | 11 |
04-09-2013
06:25 AM
No, I have already implemented this. I mean connecting directly to the firewall API, not through a UID agent. Thanks.
... View more
04-08-2013
01:05 PM
Good afternoon, Previously we used the PAN-UID perl module to update User ID Agents running on servers, which would in turn update the firewalls. With version 5.0, there is not this capability: 2.9 User-ID mapping Beginning with PAN-OS 5.0.0, you can apply User-ID mapping information directly to the firewall using the API with the type= user-id parameter. Has anyone implemented this? Can you provide any examples? The documentation is kind of limited & we are having a lot of trouble with the UserID Agents having memory leaks and not working. Thanks for your help. Kevin
... View more
Labels:
- Labels:
-
User-ID
03-15-2013
10:53 AM
Unfortunately, this did not work for me. After working with Kiwi support (which was completely useless) I gave up on them and went a different direction. My script runs scheduled & farms the log files, parsing out what i need then calling the PA UID API to pass it on. So I am not longer using that line to pull data from kiwi. This is probably better anyway as the script is called once a minute rather than every time a log entry comes in... sorry I can't be more help.
... View more
01-30-2013
09:19 AM
Nevermind, I figured out where to launch the script from in Kiwi.
... View more
01-30-2013
09:03 AM
I am confused by the perl script at the end of the UserID API Integration document. This line: $ string = Fields . VarCleanMessageText ; #Kiwi syslog variable for message text I am not getting anything from this field. What do I have to do to set this up? Thanks. Kevin
... View more
01-28-2013
10:58 AM
Thanks. I'll look into that. We are upgrading the PA's soon which will alleviate this issue to my understanding (agent-less User-ID data) but to band-aid the process I was hoping to write up a python script to just monitor the log, and if I haven't seen any user updates in 5 minutes or so, just restart the service. I'll look into the debug. Thanks for your help. Kevin
... View more
01-28-2013
07:37 AM
Hello, We currently utilize the User Identification Agent to send usernames to the PA's. However, recently, the app has been locking up. It continues to run and send information messages in the log but it does not collect usernames. I cannot monitor the service because it is still running, just not communicating. I'd like to write a script to monitor where the data is located, essentially grab tail of events, make sure the username log entries are showing up, or alert if one has not been seen in X amount of time. Where is the data located? Is it in a SQL DB? How can I get at it? Thank you. Kevin
... View more
01-14-2013
12:22 PM
Thanks, I will look into that as well. For our long term Java strategy, part of it is going to be only allowing Java to known sites we need to interact with so the blocking is helpful too. So, sorry to need continued direction, but I have created a File Block for JAR files & a Custom URL Category for allowed sites. I then create a rule allowing traffic to the allowed sites over HTTP & HTTPS, then I create a second rule for everything and link the File Block to it - is that correct? Thanks. Kevin
... View more
01-14-2013
11:41 AM
Thanks. So I create a custom URL Category called Allow_Java and then I create a Data Block rule for blocking .JAR files. How do I tie bypass the Data Block rule just for Allow_Java sites? Thank you.
... View more
01-14-2013
09:59 AM
Good morning, I am relatively new to the PA's, but was wondering if there was a way to have a list of URL's & domains to whitelist Java traffic & block everything else? And if so, can I then write any kind of regex to match specific java versions, say if we have an older version of Java that is required for a specific app for a specific site (or if its only internal and I want to block that specific older version for everyone?)? Thanks for your help. Kevin
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-18-2015
09:07 AM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks