This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About kdd
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About kdd
03-06-2019
89Posts
9Likes
6Solutions
Mar 06, 2019Last Visited
User
Activity
User
Profile
Latest posts by kdd
| Subject | Views | Posted |
|---|---|---|
| 4009 | 01-26-2017 01:59 AM | |
| 15047 | 01-25-2017 07:04 AM | |
| 7614 | 01-25-2017 05:39 AM | |
| 5766 | 01-20-2017 01:12 AM | |
| 3677 | 01-20-2017 12:55 AM | |
| 6007 | 01-19-2017 06:43 AM | |
| 5946 | 01-19-2017 05:40 AM | |
| 5959 | 01-18-2017 03:52 AM | |
| 5966 | 01-18-2017 02:30 AM | |
| 6046 | 01-17-2017 11:38 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 01-10-2017 02:02 AM | |
| 1 Like | 01-20-2017 12:55 AM | |
| 1 Like | 01-18-2017 02:30 AM | |
| 1 Like | 01-29-2014 02:55 AM | |
| 1 Like | 01-02-2013 04:37 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like | |||
| 1 Like | |||
| 2 Likes | |||
| 1 Like | |||
| 18 Likes |
User Badges
Community Statistics
| Member Since | 09-05-2011 05:38 AM |
| Date Last Visited | 03-06-2019 05:49 AM |
| Posts | 89 |
| Total Likes Received | 9 |
01-26-2017
01:59 AM
Hi MPI-AE, does the server listening to port 999 or is it 22 which is often used for ssh. As it worked before did you do nat as well ? Regards, Klaus
... View more
01-25-2017
07:04 AM
do you see "check now" at the log with the external interface and did you configure NAT as well? not the external interface - then change the service route no NAT and private IP - then used NAT with Public IP still not working - please show the log entry and rule
... View more
01-25-2017
05:39 AM
it is important that your webserver is offering the same of what is supported by palo alto. take a look here:
... View more
01-20-2017
01:12 AM
the log-entry is showing always the non-privileged user even the user starts the IE with run as. So how should this work?
... View more
01-20-2017
12:55 AM
1 Kudo
Hi Jeff, the User-ID-Agent is collecting infos of the AD-log ( successful logon events - User-ID and IP ) and push these info to the Firewall. You can see the mapping with: show user ip-user-mapping ip x.x.x.x Instead of using USER-ID-Agent running on AD-Server you can configure this function on firewall as well (called agentless) https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Agentless-User-ID/ta-p/62122 Regards, Klaus
... View more
01-19-2017
06:43 AM
Hi, this can't be solved with PAN-OS because there no log-entry at the AD-log. The way i have to go is to use the GPO for these Clients. That is the answer of our systemhouse. Regards, Klaus
... View more
01-19-2017
05:40 AM
01-18-2017
03:52 AM
i took a look at the User-Id Agent log right after the user tried it with IE (run as admin) and i didn't see an entry with the admin account. Maybe there is no entry at the AD-log and PA has no chance to get the admin account. How is it possible to catch a user like this one?
... View more
01-18-2017
02:30 AM
1 Kudo
Hi Reaper, these are domain-accounts and our User-IDAgent reads the audit-logs. Thx for your hint. I will check the log of the User-ID Agent to see what is logged. Therefor i need the help of this specific user. I keep you updated. Regards, Klaus
... View more
01-17-2017
11:38 PM
Hi all, several user have internet access and this depends on their user-id. some of them have admin-accounts and can run the ie as admin. the user logged into the AD as non-privileged user and this is controlled by the WMI-Process of the USER-Agent. But this construct didn't recognize when the user starts the IE with run as admin. is there a chance to prevent this so that the FW allow only the access for the non privileged users. Regards, Klaus
... View more
01-12-2017
11:52 PM
Hi Rahman, what about hardware failures, what about software bugs and do you can deny any need of software features ? HA gives more reliability and minimize the downtime. You apply HA so i guess there ist need of steadiness. But it depends on your company necessities. Regards, Klaus
... View more
01-10-2017
07:31 AM
yes, because thats what the server offers and i guess right now your server offers more than PA can decrypt. By the way the certificate of the root CA is only needed for ssl-forward-proxy. But thats the other direction.
... View more
01-10-2017
02:02 AM
1 Kudo
it is right that DHE and ECDHE is not supported by PA for ssl-inbound-inspection. There ist a note in the Config which point to that. therefore you have to disable these algorithms like Rahman mentioned. you will find the algorithms below Objects - Decryption Profil. DHE and ECDHE is checked but they will be used only for ssl forward proxy.
... View more
01-09-2017
07:36 AM
Hi Max, in our PA's certficate-memory are only root-certificates. two or three of them i imported to get sites decrypted. Because they weren't implicit. Do you have the root-CA as well? The intermediate will be used to issue the certificate for an aplicant. The Root-CA ensures the reliabilty of the intermediate cert. I think, you have to have der Root-CA as well. To get a DigiCert Trusted Root Authority Certificates look here digicert . Regards, Klaus
... View more
01-09-2017
06:16 AM
Both algorithms (DHE and ECDHE) are only support for SSL Forward Proxy. Not for inbound direction. Take a look at the photo.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-06-2019
05:49 AM
|
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks