About systemadmin_tu

systemadmin_tu · ‎01-18-2013

Hi all, I try to found the suitable PAN model for support my environment. I design PAN to support 2 virtual wire and 1 NAT network. I'm not sure that PA 500 will support 2 virtual wire. I prefer throughput and session number that support by PA500. Thank you TU

systemadmin_tu · ‎01-08-2013

I have the same problem with PAN OS 4.1.6 and UI agent 4.1.6-5. Help me..

systemadmin_tu · ‎01-08-2013

Dear All, My PAN is 500 with 4.1.6 OS. I just migrate PAN agent to UI agent with version 4.1.6-5. After installation and configuration, I check the user-mapping the result show as following; > show user ip-user-mapping all IP Ident. By User Idle Timeout (s) Max. Timeout (s) --------------- --------- -------------------------------- ---------------- ---------------- 192.168.28.7 Unknown unknown 2 5 192.168.41.58 Unknown unknown 0 3 110.49.235.124 Unknown unknown 0 3 113.107.137.18 Unknown unknown 1 4 192.168.28.14 Unknown unknown 0 3 10.1.199.102 GP chowalit 258273 258273 192.168.28.200 Unknown unknown 1 4 192.148.0.25 Unknown unknown 0 3 Every user is Unknown and Idle Timeout/Max Timeout is small. Help me!!! Thanks you Chowalit

systemadmin_tu · ‎03-14-2012

Sorry change "idea" to "idle"

systemadmin_tu · ‎03-14-2012

Hi all, After idea timeout was excceded(60 mins), our clients didn't know untill they open new browser session. How to configure PAN to support automatic redirect logon page on the same browser session. Thank you Chong

systemadmin_tu · ‎09-20-2011

Hi, It's ok after I open PAN agent console and click get group as you guide me. Other question is I must open PAN agent console and click get group after I add new user into AD? It isn't make sense to do this thing. I must always open PAN agent console? Thanks you TU

systemadmin_tu · ‎09-19-2011

Dear All, I just install pan-agent on my AD, windwos 2003 server, and configure PAN box to connect to this pan-agent. I can see traffic with user from AD server. I found result from command " show user ip-user-mapping all". I can list group of AD with command " debug device-server dump user-group name". However after I run command "show user pan-agent user-IDs", it didn't return result. I found some misstake. I cann't control application usage with group name from AD on security policy. Moreover, after I add user on AD, PAN box didn't update list of new user from AD. Thanks you, TU

systemadmin_tu · ‎09-13-2011

Hi marjdev, Thank for you reply. For my case, If my clients,more than 1 client, on LAN (192.168.0.0/24) to connect internet VPN server with PPTP connection at the same time. Because different client has different logon/password and they want to conect at the sametime. ------ (again)These are policy on my PAN box. NAT: 1. source zone= Inside(LAN), destination zone= Outside(internet) , source address = 192.168.x.0/24(IP of LAN subnet) , dest. address= any, service =any, source translation = dynamic-ip-and-port , translated address = y.y.y.y(IP of Outside interface) , Dest. translation = none. Security: 1. source zone = outside , source address = public IP of VPN (pptp) servers, source user = any, dest. zone = outside , dest. address = y.y.y.y(IP of Outside interface), application = any, service = any , action = allow 2. source zone = inside, source address = 192.168.x.0/24(IP of LAN subnet), source user = any, dest. zone = outside , dest. address = any, application = any, service = any , action = allow ------- Source method is "dynamic-ip-and-port". Is it ok for my case? As I maintained sometime client can connect, someteim client cann't connect. Please help me. Because my customer want to use this VPN. Thanks you TU

systemadmin_tu · ‎09-13-2011

Hi, For above rule, I cann't finish the commit. It told me with this error "device: nat rule 'NAT_rule': Mismatch static-ip address range between original address and translated addressFailed to parse nat policyCommit failed" Could you please help me. Thanks you TU

systemadmin_tu · ‎09-11-2011

The NAT rule that I refered, I use this rule to NAT our client to Internet via public IP of internet internet. So I'm not sure that if I change this configure It will effect to client's internet traffic. Let's me show you the NAT rule that should be as follow NAT: 1. source zone= Inside(LAN), destination zone= Outside(internet) , source address = 192.168.x.0/24(IP of LAN subnet) , dest. address= any, service =any, source translation = static IP , translated address = y.y.y.y(IP of Outside interface) , Bi-direction = yes , Dest. translation = none. Please correct this NAT rule. Any change please comment to me. For this NAT rule, It have any limitation for NAT traffic? Thanks you TU

systemadmin_tu · ‎09-08-2011

Hi Rechard, Sorry for delay reply. These are policy on my PAN box. NAT: 1. source zone= Inside(LAN), destination zone= Outside(internet) , source address = 192.168.x.0/24(IP of LAN subnet) , dest. address= any, service =any, source translation = dynamic-ip-and-port , translated address = y.y.y.y(IP of Outside interface) , Dest. translation = none. Security: 1. source zone = outside , source address = public IP of VPN (pptp) servers, source user = any, dest. zone = outside , dest. address = y.y.y.y(IP of Outside interface), application = any, service = any , action = allow 2. source zone = inside, source address = 192.168.x.0/24(IP of LAN subnet), source user = any, dest. zone = outside , dest. address = any, application = any, service = any , action = allow The result after commit. I noticed that sometime client can connect pptp but sometime cann't. Any missing on this configuration. Thanks you, TU

systemadmin_tu · ‎09-02-2011

Hi Renato, I have same problem with this case. So I'm new on PAN. Could you please explian how to create this kind of NAT policy. Thanks TU

systemadmin_tu · ‎09-02-2011

Dear all, I use PAN500 replace linksys firewall. I have the problem with our client that use VPN client to dialup to internet VPN server device such as router. Our diagram looklike this. Client(window XP, with MS VPN client) --> PAN500 --> VPN server(router) I try to watch monitoring traffic. I found unusual traffic with detail : From port = 0 , NAT Source Port = 0 , To Port = 0, NAT Destination Port = 0 , Application = gre With my old firewall It is ok for this case. Please help me. Thanks TU

Member Since	‎08-19-2011 01:00 AM
Date Last Visited	‎08-18-2015 09:07 AM
Posts	13

Online Status	Offline
Date Last Visited	‎08-18-2015 09:07 AM

About systemadmin_tu

Maximum number of virtual wire on PA 500

Re: Monitoring - source user not shown in log

Unknown user after install and configure UI Agen

Re: Automatic redirect logon page after idle timeout was exceeded on captive portal.

Automatic redirect logon page after idea timeout was exceeded on captive portal.

Maximum number of virtual wire on PA 500

Re: Monitoring - source user not shown in log

Unknown user after install and configure UI Agen

Re: Automatic redirect logon page after idle timeout was exceeded on captive portal.

Automatic redirect logon page after idea timeout was exceeded on captive portal.

Re: No result from "show user pan-agent user-IDs" command

No result from "show user pan-agent user-IDs" command

Re: VPN problem with pptp and gre

Re: VPN problem with pptp and gre

Re: VPN problem with pptp and gre

Re: VPN problem with pptp and gre

Re: does palo alto support l2tp , pptp over ipsec vpn?

VPN problem with pptp and gre

Network Security

Cloud Security

Security Operations

About systemadmin_tu