About dpenhall

Any chance you can supply those as filter updates in a format that the 6.0 UserID agent can use ? We are a long way off updating to 6.0.0 on the gateways so getting this feature in the UserID agent is great...its just getting it to work is a problem. Cisco ISE filters would be great as well . ... View more

Hey Hulk,       Thanks for that, should have also mentioned the we are running Panorama so figured had to run these commands on that device. - set cli config-output-format set - configure - show device-group "Policy Name" pre-rulebase security rules Key issue is that match command doesnt work here so had to manually copy from the CLI output and search via notepad. ... View more

Thanks for the reply. Since we have multiple different vulnerability profiles, under the policies tab ( as below ) I want to show in the rulebase GUI where each vulnerability profile is used. Similar to if I was looking for a address object I would put the objects name in the search bar of the policies tab and the rule base would then only show me rules where that object is in use. I was looking for away of NOT having to check each vulnerability in a 200 rule + config by manually having to check each rule and what vulnerability profile is assigned. Does that make it clearer ? Screenshot taken from home PA, not work policy in question. ... View more

There is a limitation of User-Agents based on the hardware. Max agents on the 5060 we run is a 1000 and goes down from there. There is a "show system ?" command and you run a match for "max" outputs a bunch of limits for your machine including the TSA agents. Haven't got the command handy to find but will try and remember to reply to this thread with it when I get into work. Edit: show system state | match cfg.general.max-tsagents. I did notice on one of our PA-5060 running 4.1.12 the limit was 2000 ( pretty sure 4.0.x was only 1000 ). A PA-5060 running 5.0.6 in our environment is 1000. ... View more