About dpalani

mivaldi · ‎11-04-2016

For GMail you also need to block the 'quic' application with a policy that precedes the policy that ties to the File Blocking profile. Refer to https://live.paloaltonetworks.com/t5/Configuration-Articles/Google-Services-are-Not-Decrypted-when-Accessed-from-Chrome/ta-p/65518

dpalani · ‎04-16-2014

Oracle PLM uses tcp port 1521, if I am right. If that is the case application signature is available on the firewall. The application is named as "oracle" HTH

CLIGURU · ‎04-27-2014

I installed the license and wait for a day but I can see the logs now. Thank you panos

_slv_ · ‎04-16-2014

from 6.0.1-2 tech note https://downloads.paloaltonetworks.com/software/User-ID_Agent-6.0.1-RN.pdf?__gda__=1397676798_23c31b2f09e0be1f6752060ff1… Operating System (OS) Compatibility User-ID Agent 6.0 The following table lists the supported operating systems for the User-ID Agent: Host Computers • Microsoft Windows XP/Vista/7 • Microsoft Windows Server 2003/2003 R2 • Microsoft Windows Server 2008/2008 R2 Regards Slawek

mobradovic · ‎04-29-2014

Thanks but that didn't work, and I'm at PAN-OS 5.0.9, It just kept trying to upload the file, but I got an error in IE. I'm thinking it is the IE 8 version, I'm in a closed environment and can't change the setting in IE. So I'll have to do it via the mgmt port at the firewall not from my desktop. Thanks M

dmaynard · ‎05-21-2014

Is this a multi domain environment and do you have server session read enabled? For multiple domain environments the data gathered from open sessions may not be accurate. This method does not deliver domain data with the user name and it is assumed that the user is a member of the domain that the monitored server is part of.

dpalani · ‎04-18-2014

Hello, If the firewall/agent is receiving traffic form an ip it does not have user mapping info for, it will probe that ip to get that info. We need to check if the host responds to wmi probes by probing the ip address manually from another host or a host with domain admin login Following is the command you can run on a cmd, wmic /Node:192.168.128.16 ComptuerSystem Get UserName HTH Deepak

dpalani · ‎04-11-2014

No, you do not have to create class for each application, by classifying an application to a class (multiple applications can be classified to one class). Traffic/applications that belongs to one class will be put in a queue for that class for utilizing the bandwidth, eg. you can classify youtube and netflix as class 3 and say that maximum guaranteed is 2 mbps. This 2 mbps will be shared by these applications, this does not necessarily mean youtube will get 1 mpbs and 1mpbs for netflix. If no one is using netflix youtube traffic will get 2 mbps. Hope that helps. Regards, Deepak

Register_Security · ‎04-21-2014

Are there any screenshort for heartbleed attack into system ? Please share ?

santonic · ‎04-11-2014

I've just realised, that CET is actually CEST at the moment because we're on summer time. So it's not 3 letter right now.

santonic · ‎04-14-2014

Yep, we started with dedicated user with only required permissions according to PA guide. However customer has 2003 AD and 'event reader' groups is not present there. So instead of going through specific procedure for 2003 AD permissions (also described in one of the PA guides), the customer decided to give domain admin rights to the user.

pulukas · ‎04-07-2014

I'm surprised to see this crop up. There were HA issues in 5.0.10 and the release notes for 5.0.11 note the three HA bugs fixed by this release. You may have run into a new bug with this issue. PAN-OS 5.0.11: Addressed Issues You may want to open an ticket so it can be examined by support to confirm if this is a problem or not. And if it is get it into the bug fix chain.

dpalani · ‎12-31-2013

Lets say there was never an application shift, even in this case there will be two logs for the same session id. This is because the firewall does a security policy look up to allow the service first (i.e the SYN in a TCP session ), since this is the start of the session a log will be generated for this. Once the application is identified and session is closed the log at session end will generate a traffic log for this. Form a information POV the log at session end will have more info than log at session start in terms of number of bytes sent in C2S and S2C flow. You'll end up with duplicate logs for the same session. In which one is more useful than the other based on the issue you are troubleshooting. Regards, Deepak

apasupulati · ‎12-31-2013

Also, if you're new to deploying User identification on the firewall, here's a good document to get a good understanding on how it works - https://live.paloaltonetworks.com/docs/DOC-5939

homicidedart · ‎12-30-2013

Thanks deepak for your support. I'll open up a case. My best wishes. Maher

hyadavalli · ‎12-14-2013

Hello Smi, Please take a look at below document explaining about packet flow in panos. https://live.paloaltonetworks.com/docs/DOC-1628 Regards, Hari Yadavalli

mariusz_sawczuk · ‎02-05-2014

I've upgraded my PAN device even to PAN-OS 6.0, and still ssh decryption doesn't work properly. I've tried with and without decryption profiles enabled.

dpalani · ‎12-12-2013

Try adding the distinguished name of the group in the security policy, the firewall will identify the short name and populate it automatically with the correct group icon. Deepak

kalyanram.piratla · ‎10-08-2013

I will not permitted to do this on the live units specially when the configurations do synchronize. Secondly, I do not have spare PA-5050s to play with or for a matter of fact no spare PAs to play with...

dpalani · ‎10-07-2013

The hostname is unique to each device so you can use a ignore list, the administrator name may be the same but, the domain the user name is in are different.

sd@censhare.com · ‎09-05-2014

Last post on Oct 8, 2013 6:29 AM but I got the same issue and maybe it will help the next person My Environment: PA-500 with PanOS 6.0.4 External voip Server from nfon incl snom phones + patton. Hints in other discussions: Application override -> problem still exist Bidirectional nat -> problem still exist ALG disabled -> problem still exist Packet capture -> I saw my packages in the "drop" log and after hours of stupid investigation, it was only the route back to my snom-clients. The crazy thing is that I was able to see all the outgoing traffic and everything looked fine but due to the misconfiguration of my route my packages were dropped and I was NOT able to see them in the Traffic monitor. Only a packed captured helped I know this is not the global solution but maybe someone is using PAN OS 6.0.x and nfon as a voip provider too. (ALG possible!)

victorallen · ‎07-24-2013

I had a user error in the NAT Thanks for your thoughts! Plus I ended up setting up a PBF rules as well.

HULK · ‎07-21-2013

Hi, Yes you are right. Please follow below mentioned documents for more in details. https://live.paloaltonetworks.com/docs/DOC-3220 Thanks Subhankar

mikand · ‎07-18-2013

Thank you for reporting back on how your case progresses - its always great when findings are "commited" back to the community so next time somebody gets these symptoms they can check with their vendor if there is a transparent proxy on the road

minow · ‎07-15-2013

thank you. we upgraded to 5.0.6 and all certificates are back in the GUI

dyang · ‎06-27-2014

Hi Joanna, Browse time calculations are only available in the User Activity Reports. If you would like to see this information elsewhere, please contact your SE and have a feature request submitted on your behalf, along with your specific use case. Thanks, Doris

mbutt · ‎07-11-2013

Below are some good docs on User id agent. https://live.paloaltonetworks.com/docs/DOC-3664 https://live.paloaltonetworks.com/docs/DOC-3120 https://live.paloaltonetworks.com/docs/DOC-1920 https://live.paloaltonetworks.com/docs/DOC-1807 https://live.paloaltonetworks.com/docs/DOC-2013 https://live.paloaltonetworks.com/docs/DOC-2019 Hope this helps. Thanks

dpalani · ‎07-11-2013

Commit in general has two phases. Phase 1: validation Phase 2: pushing the config to each process The change you made( adding an administrator) had failed since the authd was not validating the config. To get more info on why the candidate config was not being accepted you can look into the authd logs during the time frame when the commit was pushed.

uscit · ‎07-10-2013

I did that this morning, and it worked fine. Thanks!

apasupulati · ‎07-09-2013

Hello, Is PAN firewall retrieving the user-group information properly? >show user group name <group name> //this should list all the group members of the group >show user user-IDs match user <username> //shows the groups a user is a part of. If the firewall is able to identify the users in the group and see traffic logs for these users, it should match the query for the report. Thanks, Aditi

Date Registered	‎01-11-2012 01:32 PM
Date Last Visited	yesterday
Total Messages Posted	76
Total Likes Received	27

Online Status	Offline
Date Last Visited	yesterday

Strata

Prisma

Cortex

About dpalani