About jseals

Hi Richard, I haven't found a command just yet, but you should be able to goto the threat logs in the webUI, create an action filter that equals "block-ip" and run the filter in the logs. This should show you what IPs are getting blocked and when. On a side note, for this to be more real-time, you may want to enable logging at the start of the session for the rule that's logging your block-ip threats. -Jason ... View more

You can clear the group cache on 4.1.x by doing the following: > debug user-id clear group all You can then force a group refresh: > debug user-id refresh group-mapping all -Jason ... View more

Hi Mike, It sounds like you're running into a reported issue we've encountered here. There is a fix in 4.1.5 for this. I believe as a work-around you can edit parts of the profile in the security rule to force the response page switch. -Jason ... View more

Hello, A shadow rule warning means that a more generic rule is configured above a more specific rule. Therefore, the generic rule is always hit and the more specific rule is never hit. Will packets flowing through the rulebase you have ever hit the rule that's being shadowed, or will they always hit the rule that is shadowing? If you feel this isn't the case for you, maybe give us examples of what your rules look like so we can help. -Jason ... View more

Hello Guillaume, I don't see an application for ironport in my lab device. Do you have one, or have you manually created one? Often times applications use various protocols such as web-browsing, and then they transition into something else. This may be what you're seeing. I'd suggest getting with your Palo Alto sales engineer and request an application to be created for this traffic as I don't currently see one. At that point we'll be able to identify it correctly. Until then, you can create a service based rule using the ports needed for ironport if you'd like. -Jason ... View more

Hello, We do not have anything that I can think of that is similar to demo mode in Check Point's Dashboard. We have some general getting started documents, a very good document that details any kind of NAT you'd like, but nothing like demo mode. The only thing I can think of that is similar is we do have some demo appliances that I believe the Sales Engineers have access to. These include configurations that are "real world". I'd suggest asking them to take a look at one with you, or perhaps even asking them for a feature request to get a demo mode for our appliances. I agree something like that would be very useful. Also, you can find the documents I spoke of by searching our support site here. If you can't find them let us know. Thanks, Jason ... View more

Hello, There could really be a lot of causes for this. First, I'd look over this very useful document if you haven't already. https://live.paloaltonetworks.com/docs/DOC-2019 It goes over the needed steps when upgrading the agent like you've done. After all of that is veriifed and looks okay, get a ssh session on the firewall and run: > show user ip-user-mapping all If you don't see any mappings there, goto the UID agent on your Windows server and see if it has any mappings. It's important to know where the lack of mappings is happening at for troubleshooting. Thanks, Jason ... View more

Hello, You don't remember making any changes around the time it started to fail? A phase-1 timeout can typically mean the packets are getting dropped or misrouted. One side is waiting for the phase-1 packets and is never getting them properly, so it times out. You can look in the logs and see if it's dropping, or if you see the IKE traffic being allowed as it should. By reinput the key, do you mean that you cleared the SAs and tried to re-establish the tunnel? If not, I'd try that as well. If you want to look at the logs, you can create an untrust to untrust rule and enable logging. This way you see the IKE traffic. Let us know, Jason ... View more

Here are some updated docs for the newer agent and 4.1.x software. Please let us know if this is what you were looking for. 4.1 Agent setup: https://live.paloaltonetworks.com/docs/DOC-2132 4.1 User-ID Tech Note: https://live.paloaltonetworks.com/docs/DOC-3120 Thanks, Jason Seals ... View more

Hi Robert, The agent does not need to be installed directly on the DC. Just a machine that can read the DC's security logs. However, installing it directly on the DC can rule out some communication issues. As Saba said, it could be your zone not having userID checked. Since the firewall doesn't show the mappings, take a look at the agent and see if it's getting any mappings and is just having issues sending them to the firewall. Thanks, Jason Seals ... View more

Yes, or give us some feedback on if your buffers were depleted or not. Thanks, Jason Seals ... View more

Hi Robert, Has this ever worked before, or is this a new installation? Also, what version of the user-id agent and PAN OS Software are you running? A few things you can do is check to see if the firewall has any correct mappings by running: > show user ip-user-mapping all If they are showing as unknown, then you need to open the agent installed on your DC and look to see if it's getting the correct mappings. Thanks, Jason Seals ... View more