About dpenhall

Any chance you can supply those as filter updates in a format that the 6.0 UserID agent can use ? We are a long way off updating to 6.0.0 on the gateways so getting this feature in the UserID agent is great...its just getting it to work is a problem. Cisco ISE filters would be great as well . ... View more

Hey Hulk,       Thanks for that, should have also mentioned the we are running Panorama so figured had to run these commands on that device. - set cli config-output-format set - configure - show device-group "Policy Name" pre-rulebase security rules Key issue is that match command doesnt work here so had to manually copy from the CLI output and search via notepad. ... View more

Thanks for the reply. Since we have multiple different vulnerability profiles, under the policies tab ( as below ) I want to show in the rulebase GUI where each vulnerability profile is used. Similar to if I was looking for a address object I would put the objects name in the search bar of the policies tab and the rule base would then only show me rules where that object is in use. I was looking for away of NOT having to check each vulnerability in a 200 rule + config by manually having to check each rule and what vulnerability profile is assigned. Does that make it clearer ? Screenshot taken from home PA, not work policy in question. ... View more

There is a limitation of User-Agents based on the hardware. Max agents on the 5060 we run is a 1000 and goes down from there. There is a "show system ?" command and you run a match for "max" outputs a bunch of limits for your machine including the TSA agents. Haven't got the command handy to find but will try and remember to reply to this thread with it when I get into work. Edit: show system state | match cfg.general.max-tsagents. I did notice on one of our PA-5060 running 4.1.12 the limit was 2000 ( pretty sure 4.0.x was only 1000 ). A PA-5060 running 5.0.6 in our environment is 1000. ... View more

Ok, created 2 new servers running the latest agents and manually set them up for equal load. Servers running the older version 4 User agent are still having issues and version 5 servers are stable. Upgrading the original servers to User agent 5.x tonight. Thanks for the info Alex, worked well. ... View more

Sounds interesting to use version 5.x agents on 4.1 devices and it works. I have never had to much luck with backward/forward compatibility with different parts of the PA platform ( talking around the threat management space there ). Will update one agent and see how that goes. Dan ... View more

Hi Greg,     I was reading the notes for 4.1.7 and was planning on doing that in a week or so after my company wide change freeze is over. Is there any other suggestions you can put forward ? ... View more

Hi Ben,          Excellent, thanks for that. Exactly the work around I need. I will forward the suggestion on via the correct channels. Daniel Edit: No actually. That doesnt work.Used on Panorama version 4.x u318125@PA-Panorama-UAT> set cli config-output-format set u318125@PA-Panorama-UAT> configure Entering configuration mode [edit] u318125@PA-Panorama-UAT# show shared address set shared address Gbl_nfwtn01 ip-netmask 10.49.254.242/32 set shared address Gbl_nfwtx01 ip-netmask 10.254.6.242/32 set shared address Gbl_srv-dmzn-msecdrf01 ip-netmask 192.168.125.201/32 set shared address Gbl_srv-dmzn-msecprd01 ip-netmask 192.168.125.200/32 set shared address PBNEPLKAPP4001 ip-netmask 10.70.169.161/32 ... View more

Hi Benjamin, thanks for the feedback. Surely there must be a simplier approach than what you have described ? I should have specified that the subnet that I want to check availabiltiy for is a external facing subnet ( public IPs ) that are all NATed on our firewall. i.e. Website hosted behind our firewall. Why must I examine the traffic logs for this and NOT looking at the actual address objects ? Seems a bit counter-intutive to me. ... View more