About RussMcIntire

I have setup user-id mapping using the instruction here: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/user-id/map-ip-addresses-to-users/configure-user-mapping-using-the-windows-user-id-agent.html#idf8932678-911a-4153-ab89-94f19b988aef   I have 2 servers with the user-id agent and 2 servers with the terminal server agent all set up and working. If I go into monitoring, i can see logs populating just fine and if I go into the cli and run  show user ip-user-mapping all All the users show up mapped correctly.   Initially, we were trying to do user mapping by implementing User Mapping Using the PAN-OS Integrated User-ID Agent. We didn't like this solution and backed it all out.  In the 2 weeks since, the only thing we did was upgrade the Pan-Os to version 9.0.8 and now when we run a commit, we intermittently receive the following error:   user-id-service is enabled, but no user-id-agent is configured for ntlm-auth   I think this may be left over from when we were trying to implement the integrated user-id agent. I have searched for a similar error but can't find anything close.   In the firewall, in device>user identification> user-ID agents, in the properties of the server, do I need to check the " Use for NTLM Authentication" check box since we are still using NTLM authentication to clear the error?   ... View more

We are currently running DHCP off of our firewall for all external VPN users. I would like to move this DHCP to our 2019 windows servers. I have looked around trying to find out how to move this but can't find much. Can someone point me in the right direction? ... View more

I am fairly new to Palo Alto so please forgive me if this is a simple answer or answered somewhere else. I have a requirement to lock down our Global protect for our vendors. Here is what I have. I have group mappings and User-ID mappings set up and working fine. I have 2 GP portals and 2 gateways set up. 1 portal\gateway for company users and 1 portal\gateway for vendors. I have 1 tunnel for my Corporate VPN and 1 Tunnel for my Vendor VPN The company portal comes in on one external IP address and the vendor comes in on a different IP address.   I have 3 security zones set up. Trust (Internal network) Untrust ( external network) company VPN users enter through this zone. Vendor (external network) All vendors enter through this zone. The Untrust & Vendor zone traffic come in on the same external Interface (11) and the trust traffic leaves out external interface (11)   At this time, the company VPN works just fine and all authorized users can access all resources.   The Vendor VPN users can connect but I can't seem to figure out how to lock them down to only access certain servers or applications. In the GP gateway for the vendors, I have the appropriate VLAN allowed in the Split tunnel config.   I have been working with the security policies and I think my answer lies there but I am not sure how to get there from here.   In testing, the vendors have access to the appropriate VLAN, they only have RDP access (No http/https/etc) to the appropriate server(s) but just by IP only, not name.   I can see in the monitoring logs the port 53 traffic to my domain controllers is being denied by the interzone-default rule. Do I need to allow some sort of domain services so this flows as I want? If so, how is the best way to accomplish this?   I can't seem to figure out what I am missing. Any help would be great.     ... View more

I am working on a network segmentation project for our organization. We currently run Cisco switches and all devices reside on the default VLAN, VLAN 1. All routing is currently done on our PA-850. On the PA-850, I have configured the new VLAN's as sub-interfaces and all switches for layer 2. If I put a PC on any VLAN and set a static IP address, I can ping all gateways and any other IP address on any other VLAN. So far so good.   The issue I have is DHCP. I can get DHCP addresses for VLAN 1 (the Cisco default VLAN) from our Windows 2019 servers, but no other VLAN even though DHCP helpers are configured on the switches. On the switches, VLAN 1 is un-tagged but all other VLAN's are tagged.   Is it possible to set up a DHCP relay on the PA-850 so the added VLAN's can pull an address from the windows DHCP server? If so, can anyone give me some guidance on how to proceed?   Any help would be greatly appreciated. ... View more