About N2Z2

Hi all, I need to automate the export to csv for a specific query for traffic log, for example (zone.src eq myzone) and (time_generated in last-calendar-day) and I must have the same fields extracted from the gui, without limit to the rows retrieved.   I've tried to: - export the command from cli to csv -> nothing useful - create a custom report -> field are not the same, limit of 10k rows - python script -> how can I pass the query to the instance of Firewall object with fw.op(...) ?   I can use a curl script, and it's working, but I hope for a more "elegant" solution   Any hint?   Thanks   ... View more

Hi all, I'm trying to connect to vpn using vpnc. Everything works fine, but if I restrict the region in the gateway, vpnc does not connect because it is shown as "Client region: (null)" Any experience on this? Thanks ... View more

Hi all, let's suppose these conditions:   - interface with dhcp enabled, 24 hours lease timeout, ip range (for example) 192.168.3.0/24 - user-id agent enabled with 45 minutes timeout - virtual machine environment with non persistent vm, so when a machine is powered off it will be destroyed and recreated with a new mac address - a machine cannot do web-browsing without user-id   An example:   26/04/2022 11:03:49 -> machine MACHINE1 got ip from dhcp, 192.168.3.1 27/04/2022 11:00:00 -> user USER1 log into MACHINE1, so a user-id mapping will be created between 192.168.3.1 and USER1 27/04/2022 11:02:00 -> user USER1 log off from MACHINE1 27/04/2022 11:02:30 -> machine MACHINE1 will be recreated with a new mac address and got 192.68.3.100 from dhcp 27/04/2022 11:03:00 -> machine MACHINE1 release dhcp address got 24 hours ago 27/04/2022 11:20:00 -> a user with a pc connect his machine to the network and he got 192.168.3.1 Between 11:20:00 and 11:45:00 the user "unknown" with his pc can do web-browsing with ip 192.168.3.1 because he's recognized as USER1 27/04/2022 11:45:00 -> the user-id mapping between USER1 and 192.168.3.1 will be deleted, the "unknown" user can't web-browsing anymore   This could cause - unknown user do web-browsing without having rights - unknown user could visit sites as USER1, so the logs are not consistent - unknown user can have access to other network segment due to the fact that he is presenting as USER1 - and so on..   Any hint on this, other that reducing dhcp timeout that could mitigate a bit the problem, but it doesn't resolve it?   Obviously the ideal could be that the dhcp does not assign an ip if there is already a user-id agent associated to the same ip with a different mac address, but I think I'm asking too much..   Thanks ... View more