About kdd

kdd · ‎01-26-2017

Hi MPI-AE, does the server listening to port 999 or is it 22 which is often used for ssh. As it worked before did you do nat as well ? Regards, Klaus

kdd · ‎01-25-2017

do you see "check now" at the log with the external interface and did you configure NAT as well? not the external interface - then change the service route no NAT and private IP - then used NAT with Public IP still not working - please show the log entry and rule

kdd · ‎01-25-2017

it is important that your webserver is offering the same of what is supported by palo alto. take a look here:

kdd · ‎01-20-2017

the log-entry is showing always the non-privileged user even the user starts the IE with run as. So how should this work?

kdd · ‎01-20-2017

Hi Jeff, the User-ID-Agent is collecting infos of the AD-log ( successful logon events - User-ID and IP ) and push these info to the Firewall. You can see the mapping with: show user ip-user-mapping ip x.x.x.x Instead of using USER-ID-Agent running on AD-Server you can configure this function on firewall as well (called agentless) https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Agentless-User-ID/ta-p/62122 Regards, Klaus

kdd · ‎01-19-2017

Hi, this can't be solved with PAN-OS because there no log-entry at the AD-log. The way i have to go is to use the GPO for these Clients. That is the answer of our systemhouse. Regards, Klaus

kdd · ‎01-19-2017

kdd · ‎01-18-2017

i took a look at the User-Id Agent log right after the user tried it with IE (run as admin) and i didn't see an entry with the admin account. Maybe there is no entry at the AD-log and PA has no chance to get the admin account. How is it possible to catch a user like this one?

kdd · ‎01-18-2017

Hi Reaper, these are domain-accounts and our User-IDAgent reads the audit-logs. Thx for your hint. I will check the log of the User-ID Agent to see what is logged. Therefor i need the help of this specific user. I keep you updated. Regards, Klaus

kdd · ‎01-17-2017

Hi all, several user have internet access and this depends on their user-id. some of them have admin-accounts and can run the ie as admin. the user logged into the AD as non-privileged user and this is controlled by the WMI-Process of the USER-Agent. But this construct didn't recognize when the user starts the IE with run as admin. is there a chance to prevent this so that the FW allow only the access for the non privileged users. Regards, Klaus

kdd · ‎01-12-2017

Hi Rahman, what about hardware failures, what about software bugs and do you can deny any need of software features ? HA gives more reliability and minimize the downtime. You apply HA so i guess there ist need of steadiness. But it depends on your company necessities. Regards, Klaus

kdd · ‎01-10-2017

yes, because thats what the server offers and i guess right now your server offers more than PA can decrypt. By the way the certificate of the root CA is only needed for ssl-forward-proxy. But thats the other direction.

kdd · ‎01-10-2017

it is right that DHE and ECDHE is not supported by PA for ssl-inbound-inspection. There ist a note in the Config which point to that. therefore you have to disable these algorithms like Rahman mentioned. you will find the algorithms below Objects - Decryption Profil. DHE and ECDHE is checked but they will be used only for ssl forward proxy.

kdd · ‎01-09-2017

Hi Max, in our PA's certficate-memory are only root-certificates. two or three of them i imported to get sites decrypted. Because they weren't implicit. Do you have the root-CA as well? The intermediate will be used to issue the certificate for an aplicant. The Root-CA ensures the reliabilty of the intermediate cert. I think, you have to have der Root-CA as well. To get a DigiCert Trusted Root Authority Certificates look here digicert . Regards, Klaus

kdd · ‎01-09-2017

Both algorithms (DHE and ECDHE) are only support for SSL Forward Proxy. Not for inbound direction. Take a look at the photo.

kdd · ‎01-09-2017

take a look on the picture i think it is the DHE or ECDHE. Both are support but not for the inbound direction. Just for SSL Forward Proxy.

kdd · ‎01-09-2017

please check that the digicert-certificate is among the certificate authorities. this is necessary for trusted relationship and this to decrypt.

kdd · ‎01-06-2017

another thing is to check the decryption policy for right Decryption Profil ...

kdd · ‎01-06-2017

hi, i think it is nessesary to debug. Maybe the it is an unsupport cipher. Regards, Klaus

kdd · ‎01-06-2017

Hi, please take a look at "objects > decryption profile" and here the default profil or the your own configured profile. Take the tab "SSL-Decryption " and then "SSL Protocol Settings". Now you can choose the Protocol Version, Key Exchange Algorithms, Encryption Algorithms and Authentication Algorithms. Hope this helps. Regards, Klaus

kdd · ‎12-29-2016

Hello Raghav, please verify also the "Service Route Configuration" for your DNS-Server. You will find it here: Device > Setup > Services > Global > Services Features. Regards, Klaus

kdd · ‎11-01-2016

Hi MPI-AE, just select the port and the app-id is any. cheers, Klaus

kdd · ‎11-01-2016

Hi, if you add app-id then it is more detailed. So if you choose port 449 and app-id xyz then only app-id xyz with port 449 is allowed. regards Klaus

kdd · ‎09-28-2016

Hi, since we upgraded to 7.1.4 (we came from 6.0.4) we made good experiences. The reason why we upgraded was that the supported ciphers include DHE and ECDHE as well. But keep in mind the DHE and ECDHE algorithms are only supported for SSL Forward Proxy. Minor problems we noticed with custom reports.

kdd · ‎06-25-2015

Hi John, to get an Email: https://live.paloaltonetworks.com/docs/DOC-2390 and also under Objects/log forwarding you have chance to get an email in case of critical events. Cheers, Klaus

kdd · ‎06-19-2015

Hi ascit, if you just want to identify the user coming from proxy, then there is a way to find out who it is. Therefor the x-forwarded-for field has to be enabled on proxy and PA. On PA: to find out which ip-adress it is look into the URL-log: to get filled the URL-log you need the URL-license. Maybe this result is not what you need but that is what is possible right now. Regards, Klaus

kdd · ‎06-19-2015

Hi ascit, if you just want to identify the user coming from proxy, then there is a way to find out who it is. Therefor the x-forwarded-for field has to be enabled on proxy and PA. On PA: to find out which ip-adress it is look into the URL-log: to get filled the URL-log you need the URL-license. Maybe this result is not what you need but that is what is possible right now. Regards, Klaus

kdd · ‎03-26-2014

Hi Per, to control what is being decryped take look on a log-entry which you want to check when decrypted is checked you can be shure Regards Klaus

kdd · ‎03-24-2014

Hi Register_Security how about this cli: show interface ethernet1/1 there you will find wire-speed and much more data Regards Klaus

kdd · ‎03-24-2014

Hi kdaitadmin, to set up a signature go the objects tab, -> Application and -> Add chose the parameter which will be shown in the log for this signature and then go to the signature tab and choose add to open this menu assign a signature name and choose the add condition you want afterwards the menu with http header options appear assign a pattern and to be more precise choose a qualifier / method. this depends on the context you have choosen before pattern syntax https://live.paloaltonetworks.com/docs/DOC-1499 hope this helps Regards Klaus

Date Registered	‎09-05-2011 05:38 AM
Date Last Visited	‎03-06-2019 05:49 AM
Total Messages Posted	89
Total Likes Received	9

Online Status	Offline
Date Last Visited	‎03-06-2019 05:49 AM

Strata

Prisma

Cortex

About kdd