About jseals

Hi Richard, I haven't found a command just yet, but you should be able to goto the threat logs in the webUI, create an action filter that equals "block-ip" and run the filter in the logs. This should show you what IPs are getting blocked and when. On a side note, for this to be more real-time, you may want to enable logging at the start of the session for the rule that's logging your block-ip threats. -Jason ... View more

You can clear the group cache on 4.1.x by doing the following: > debug user-id clear group all You can then force a group refresh: > debug user-id refresh group-mapping all -Jason ... View more

Hi Mike, It sounds like you're running into a reported issue we've encountered here. There is a fix in 4.1.5 for this. I believe as a work-around you can edit parts of the profile in the security rule to force the response page switch. -Jason ... View more

Hello, A shadow rule warning means that a more generic rule is configured above a more specific rule. Therefore, the generic rule is always hit and the more specific rule is never hit. Will packets flowing through the rulebase you have ever hit the rule that's being shadowed, or will they always hit the rule that is shadowing? If you feel this isn't the case for you, maybe give us examples of what your rules look like so we can help. -Jason ... View more

Hello Guillaume, I don't see an application for ironport in my lab device. Do you have one, or have you manually created one? Often times applications use various protocols such as web-browsing, and then they transition into something else. This may be what you're seeing. I'd suggest getting with your Palo Alto sales engineer and request an application to be created for this traffic as I don't currently see one. At that point we'll be able to identify it correctly. Until then, you can create a service based rule using the ports needed for ironport if you'd like. -Jason ... View more

Hello, We do not have anything that I can think of that is similar to demo mode in Check Point's Dashboard. We have some general getting started documents, a very good document that details any kind of NAT you'd like, but nothing like demo mode. The only thing I can think of that is similar is we do have some demo appliances that I believe the Sales Engineers have access to. These include configurations that are "real world". I'd suggest asking them to take a look at one with you, or perhaps even asking them for a feature request to get a demo mode for our appliances. I agree something like that would be very useful. Also, you can find the documents I spoke of by searching our support site here. If you can't find them let us know. Thanks, Jason ... View more

Hello, There could really be a lot of causes for this. First, I'd look over this very useful document if you haven't already. https://live.paloaltonetworks.com/docs/DOC-2019 It goes over the needed steps when upgrading the agent like you've done. After all of that is veriifed and looks okay, get a ssh session on the firewall and run: > show user ip-user-mapping all If you don't see any mappings there, goto the UID agent on your Windows server and see if it has any mappings. It's important to know where the lack of mappings is happening at for troubleshooting. Thanks, Jason ... View more

Hello, You don't remember making any changes around the time it started to fail? A phase-1 timeout can typically mean the packets are getting dropped or misrouted. One side is waiting for the phase-1 packets and is never getting them properly, so it times out. You can look in the logs and see if it's dropping, or if you see the IKE traffic being allowed as it should. By reinput the key, do you mean that you cleared the SAs and tried to re-establish the tunnel? If not, I'd try that as well. If you want to look at the logs, you can create an untrust to untrust rule and enable logging. This way you see the IKE traffic. Let us know, Jason ... View more

Here are some updated docs for the newer agent and 4.1.x software. Please let us know if this is what you were looking for. 4.1 Agent setup: https://live.paloaltonetworks.com/docs/DOC-2132 4.1 User-ID Tech Note: https://live.paloaltonetworks.com/docs/DOC-3120 Thanks, Jason Seals ... View more

Hi Robert, The agent does not need to be installed directly on the DC. Just a machine that can read the DC's security logs. However, installing it directly on the DC can rule out some communication issues. As Saba said, it could be your zone not having userID checked. Since the firewall doesn't show the mappings, take a look at the agent and see if it's getting any mappings and is just having issues sending them to the firewall. Thanks, Jason Seals ... View more

Yes, or give us some feedback on if your buffers were depleted or not. Thanks, Jason Seals ... View more

Hi Robert, Has this ever worked before, or is this a new installation? Also, what version of the user-id agent and PAN OS Software are you running? A few things you can do is check to see if the firewall has any correct mappings by running: > show user ip-user-mapping all If they are showing as unknown, then you need to open the agent installed on your DC and look to see if it's getting the correct mappings. Thanks, Jason Seals ... View more

Hi Frédéric, I see some similar cases to the behavior you're describing. I'm glad to see you were able to work around the issue. It looks like you should also be able to revert the config, and do a commit force from the cli to get around this error. This seems like more of a work-around though. If you run into the issue again, it may be wise to open a case and see if we can debug the issue to find a root cause. Thanks, Jason Seals ... View more

Hi Mario, It looks like you've run into a known issue we've found on our side. What version were you on before the upgrade, and what version are you upgrading to? Regardless, A work-around is to goto the software page in the Webui, and Reinstall your current software version. After you reinstall, try the upgrade again, it should work. I believe this is an issue they're still investigating, but you can easily use the workaround until a fix is released. Thanks, Jason Seals ... View more

Hello, Unfortunately the GP client is unable to change the password for the user at this time. This will have to be done through other methods. If the password has expired and the user is no longer able to login to AD, then it will not let him login to Global Protect since all the GP client does is query the LDAP for the login process. I see that there is already a feature request submitted to allow the user to use the GP client to change the password. However, if you'd like to see this implemented in a future release, I would suggest contacting your Palo Alto Networks sales engineer and work with him to submit the same feature request. Please let us know if you need help finding out who your SE is, or if you have any further questions. Thanks, Jason Seals ... View more

Hi, That sounds great. Please keep us informed. Thanks, Jason ... View more

Hi Cristof, It may be best to continue troubleshooting in a support case at this point for more direct support. Please open up a support case and we can work to a faster resolution. Thanks, Jason ... View more

Hello, If you imported the MIB files and you're using a viewer, or you performed a snmpwalk and you don't see them, I would assume they don't exist. I've looked for these OIDs and haven't found anything as well. Sorry. If these are something you'd really like to see it would be worth it to contact your Sales Engineer to request these OIDs. Perhaps we can get them added in a future release. Thanks, Jason Seals ... View more

Hello, By design Captive-Portal will only redirect to the login page if the user is considered "unknown" by the firewall. The only way I can think of to force the user to login again manually is by running: > clear user-cache ip x.x.x.x Of course this isn't ideal, because you'll have to manually clear the user-ip-mapping for each user manually from the cli. The only other thing I can think of that may help is if you lowered the expiration timer for the Captive-Portal mappings. Thanks, Jason Seals ... View more

Hello, If you goto the support portal's homepage, then to technical documentation, you can download the PAN MIB Modules for your specific software version. This includes every MIB we have. Thanks, Jason Seals ... View more

Hi Gildas, You're going to want the 3.1.2 version of the agent if you're on 4.0.9. If you ever upgrade to PAN-OS 4.1.x, the 3.1.2 agent will still work on the newer code. However, it's suggested to upgrade the agent with your PAN-OS code. Thanks, Jason Seals ... View more

Hello, I believe any SMTP server should work. I've recently set this up in my lab with a basic SMTP Ubuntu install and it works fine. In the service route configuration, have you left emails to go out the default (management interface)? If so, can the management interface communicate to the email server via ping or telnet to port 25? You can look in the ms.log for information or errors pertaining to failed emails. This may give us more clues as to why it's failing. > tail follow yes lines 25 mp-log ms.log Then run the test again, and look to see if any errors are showing. Thanks, Jason Seals ... View more

Hello, Since it's not in the list, and I've personally never tried it I can't gaurantee it will work. However, I'd think that it should. Here is a list of things you need to go through for any client running 64 bit Windows: https://live.paloaltonetworks.com/docs/DOC-1584 I can't find any instances yet of someone trying XP 64 bit, but I'll keep looking. Thanks, Jason Seals ... View more