About Jeff_K

In regard to the Captive portal comfort page, it would be great if the user input form script called by <pan_form/> could be modified to include a field to enter the domain ... this would avoid a lot of confusion.  Anyone know if this is possible? Thanks, Jeff K ... View more

This is useful information.  I can see this working for a single domain but we have multi domains. I suppose I could put a bogus domain name in the RADIUS profile, then at least the authentication attempts will fail and a bad ip-user-mapping will not be created. I subsequently tried this but got undesirable results.  An authentication request with domain information is passed untouched to the RADIUS server but the resulting ip-user-mapping is created with whatever domain is set in the RADIUS profile. Thanks!  Jeff K ... View more

Yes, you can write security policies as you describe. We're running over 30 User-ID Agents (version 4.1.2).   They're collecting AD account logon information from the security logs of our Windows domain controllers.   We found it best to place one (or more for redundancy) at each site ... they can consume a considerable amount of bandwidth if you have an agent monitoring a domain controller over a WAN link. We have yet to address the many wireless devices in our company that do not log on to our Windows domain ... Android phones and tablets, iPads, warehouse barcode scanners, etc.   The plan is to glean user/IP information from the RADIUS MS-PEAP authentication records and feed it into the User-ID Agent using it's API support. Jeff ... View more

I had the same problem when using Firefox.  As already suggested, use IE or do it from the command line using "tftp import keypair".  Pkcs12 format is fine ... you don't need to use PEM.  Jeff ... View more

I don't think sFlow is supported in any version... just Netflow starting in version 4.1.  Jeff ... View more

The release notes confirm Netlfow support first appeared in version 4.1.   Jeff ... View more

The current documentation about "Container Pages" and the URL profile "Log container page only" option is summed up in this Knowledge Base document: https://live.paloaltonetworks.com/servlet/JiveServlet/downloadBody/2386-102-1-5808/Container%20Page%20filtering.pdf The one and only important piece of information this KB article adds is the connection between the "Log container page only" option and  \Device\Setup\Content-ID\Container Pages sjamaluddin, how do you know that "The principal of the 'Log container page only' is to log only the main page..."?  The documentation doesn't say this. Dominic, I'm not so sure the default "Container Pages" has all the content types available ... how do you know this? I'm seeking concise documentation on this topic ... where is it? Thanks!  Jeff ... View more

Yes, you need the AD group mappings in order to get the users inside of them. You can then create policies that control access based AD groups and users. Subsequently, the PAN needs the IP to user mapping that the User-ID agent provides so it can identify the user and apply the policies. Jeff ... View more

I think the User-ID Agent must process every relevant event in the security log regardless of your include/exclude list.   The include/exclude list is simply a control mechanism for what addressing the agent ultimately provides user mapping for. I think including all addressing will have negligible effect on performance.   I wouldn't want the agent to do a WMI probe of an external client.   For external users it might be better to run a separate agent with all the probing options turned off... exclude all private addressing and include 0.0.0.0/0.   Jeff ... View more

I guess the answer to my question is no.  I am surprised by this...  it's something I would expect to be able to do. My query stems from a problem I was having when using the GUI to import certificates that where externally generated and signed (for Forward Trust and Secure Web Gui use).  Through trial and error I finally was able to accomplish the import using the CLI.  I was curious to know why it didn't work using the GUI.  I may start a new discussion to expound on the certificate import issue. Thanks!  Jeff ... View more

In your pan-2 pic it shows the PAN connected but you don't have any Connected Servers (Windows Servers) ... you need to configure the User-ID Agent to monitor the security event log of specific DC's.  Do this in the 'Discovery' section.  Jeff ... View more