About apasupulati

Suhaimi, No, Ldap server is configuration is required to pull user-group mappings, not in this case. If you're sure about the service account privileges( Be sure the user is part of the Distributed COM Users, Server Operators and Event Log Readers groups. ), can you ensure the status of the AD shows up as 'Connected' on the firewall? You can run the following command to check the statistics as well- > show user server-monitor state all > show user server-monitor statistics Also, please ensure the firewall is connected to all the DC's the users are logging on to. User-ip-mappings are retrieved by the firewall by reading successful logon events from the security logs on DC. You can run 'set l' on the windows command prompt and that will show the DC user is logging onto. If all this is in place, looking at the userid debug logs should help. > debug user-id on debug > debug user-id set userid servermonitor > debug user-id set userid basic > debug user-id log-ip-user-mapping yes > tail follow yes mp-log useridd.log To turn these off- > debug user-id log-ip-user-mapping no > debug user-id unset all >debug user-id on info This will be a helpful document for you: https://live.paloaltonetworks.com/docs/DOC-5662 Hope that helps, Aditi ... View more

You should be able to configure upto 100 servers to poll, however if you have more than 10 servers, you should use a user-id agent as frequent reading of security logs from all the servers can impact the device CPU. Thanks, Aditi ... View more

Hello, The PAN firewall should allow the reverse telnet traffic to traverse the firewall, but we don't support reverse telnet to be enabled on the firewall. Thanks, Aditi ... View more

Hello, The destination NAT is like static NAT, i.e. One to One translation. It looks like you're trying to do many to many, which is not possible by destination nat. Thanks, Aditi ... View more

Enable the x-forwarded-for option on the PAN device, so the firewall can examine the HTTP headers for the X-Forwarded-for header which a proxy uses to store the original client IP address. You can then verify the URL-filtering logs to see if the real client IP is showing up in the Src field. You may also enable the Strip-x-forwarded-for option: The firewall zeros out the header value before forwarding the request, and the forwarded packets do not contain internal source IP information. Hope that helps! Aditi ... View more

So does it list the directory as empty when you run > view-pcap filter-pcap <pcap file> ? The device is running into a previously reported bug, you can restart the vardata-receiver as a workaround for the issue: >debug software restart vardata-receiver Restart of this process should not affect the Dataplane or traffic traversing the firewall. Thanks, Aditi ... View more

Hi, What you're doing will work, but you don't have to do an application override for this traffic. You can just configure a security policy, with application set to 'any' or 'custom-app' and define the service ports to allow this traffic through. By doing so you can also add security profiles to the traffic to enable inspection. app-override will not perform any scanning on the traffic and this can cause threat especially if the traffic is to/from Internet. Refer: Does application override adversely affect Threat ID? Hope that helps, Aditi ... View more

Hello, Yes, the User-ID collector firewall will pass on the user-ip-mappings(incl. captive portal & global protect). On the collector you will see the GP ip-mappings as learnt from UIA instead of GP. Refer: GlobalProtect Users Appear as Coming From User-ID Agent in IP-User Mapping How to Configure and Verify User-ID Collector in PAN-OS 5.0 Hope that helps, Aditi ... View more

Hello kpv, So I understand from your description that only the Branch location network is inaccessible by the GP users. Do you have, 1. Proxy Id for the GP subnet and remote subnet (if doing a policy based ipsec vpn) 2. Security policy from GP-tunnel zone to the Ipsec-tunnel zone on the PA500. 3. Return route/access from branch network to the GP subnet on the Peer side. Thanks, Aditi ... View more

You should be able to export the config from the Panorama VM and import it to the M-100 with no issues. Configuration like the Collector groups, managed collectors, preference lists may need to be configured after loading the VM's config to the M100 for log forwarding. 1.Save and export the Panorama VM config 2. You may edit the device IP address and hostname on the xml file and import this to the M100. 3. Load the imported config file to the M100 and commit. 4. Configure Managed log collectors and Log collector groups for log forwarding from devices. Once migration is complete, configure the firewalls to point to the M100 for log forwarding. Please refer to the below articles as well: https://live.paloaltonetworks.com/docs/DOC-5057 https://live.paloaltonetworks.com/docs/DOC-4207 ... View more

As you can see from the log details, the session start time was at 10:42 and you have the log option set to log at session end (Type: end), log generated time: 12:09. So as pointed out by Anon, these might be the old sessions which timed out much later and a log was generated at session end. Thanks, Aditi ... View more