About amansour

You can't do a client side detection in the browser as to whether or not they have it installed on that page.  The way I would do this, is to have a download page which is separate, internally accessible and then you could add a HIP check (if you have that license) which says if you already have the client, put up a block page.  Again, the links to the GP clients on the portal page are all you get, so having an internal page, maybe even one with LDAP auth is pretty easy to make, then on the hosted server you could allow/deny rules with the HIP check or have multi-language or whatever you want. Make sense? ... View more

The drop down list is populated from the LDAP server configuration.  The User-ID Agent just builds the user to IP mapping.  As for the drop-down list showing names, it should auto-populate with usernames even if you haven't explicitly included groups.  However if you want to use Groups in policy you need to include them.  If the names aren't showing up it's either the browser or the LDAP connection but the drop-down list should show usernames without groups. ... View more

Yeah, pretty slick answer. ... View more

Hey All I have the Symantec DLP 11.6 deployed with PAN in a few places.  For the integration Symantec uses PCAP (SPAN or Mirror Ports to do network detection and the response is to markup the messages (ICAP and X-Forward for Web and Email) What we recommend is creating a FlexReponse (Symantec Specific) which makes an XML call can take a quick action on the user (so far this isn't fast enough to stop because we don't have a way to instantly send the user a block page or at least haven't found it).  @jmahoney I think we should put a thread together like the SIEM one with a point person assigned for each DLP platform. Just like ArcSight and RSA and others put their SIEM integration and docs on the forum there should be an integration for each documented here.  For Symantec Email Prevent there is no integration required, for Web Prevent this ICAP integration will likely need to be supplemented with a better FlexResponse. As for the others, without ICAP we'd need a way to call the XML quickly to do something, (Block URL is the most common). But without doing a commit. Anyway happy to work on this with you guys on it we are a CPSP and ASC and Go to Partner with Symantec DLP at least. ... View more

@mikand, they should have probably labelled it forward instead of proxy.  SSL and SSH also misleading but proxy in our DLP case means re-write.  It terminates the session and re-establishes it which can work for protocols like http, https, ftp but not all applications. Those proxy features forward traffic they don't re-write it.  I think It's also why the GlobalProtect portal is only somewhere you can download the agent and not put links or content that is re-written to the internal segments like other SSL-VPNs. Also Nice Pantopia score ... View more