Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About david_rivas1
About david_rivas1
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
08-18-2015
19Posts
1Like
1Solution
Aug 18, 2015Last Visited
User
Activity
User
Profile
Latest posts by david_rivas1
| Subject | Views | Posted |
|---|---|---|
| 1179 | 10-24-2012 08:38 AM | |
| 1179 | 10-23-2012 07:23 AM | |
| 1416 | 10-22-2012 01:05 AM | |
| 257 | 08-21-2012 01:58 AM | |
| 257 | 08-21-2012 01:19 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 | 08-09-2012 04:45 AM |
User Badges
Public Statistics
| Date Registered | 01-12-2012 01:11 AM |
| Date Last Visited | 08-18-2015 09:07 AM |
| Total Messages Posted | 19 |
| Total Likes Received | 1 |
10-24-2012
08:38 AM
The machines of these users are not in domain. That is the reason I used a script (obtain mapping from wireless controller) to send this mapping to the User-ID-Agent. Maybe these users use local admin account for some applications, but I have not configured admin ignoration.
... View more
10-23-2012
07:23 AM
I tied it without success. That is strange, why I get user ip-mapping throught CLI but it is only shown in some traffic logs. :smileyconfused:
... View more
10-22-2012
01:05 AM
Hello, I have developed a script that collects user-ip mapping from a wireless controller and send this info to User-ID Agent. All these looks fine because I can see the users in the User-ID Agent monitor table, but when I look traffic logs on Palo Alto I can see some logs do not have a user identification and other logs have it, for the same source IP. I attach a screenshot where you can see what I am trying to explain :smileysilly:. The user-ip mapping is correctly catched by PaloAlto. admin@PA-500> show user ip-user-mapping ip 172.21.8.195 IP address: 172.21.8.195 User: alumnes\zwillis Ident. By: AD Idle Timeout: 3581s Max. TTL: 3581s Groups that the user belongs to (used in policy) Does anyone knows what could be happening? Cheers,
... View more
Labels:
- Labels:
-
Troubleshooting
-
User-ID
08-21-2012
01:58 AM
Hello mikand, In my wireshark capture (done using port mirroring in the switch) any packet does not show bad checksum error. When I disable offloading the packet hit the received stage and pass through firewall and users complete the pre-authentication. This case has appeared when I tried to change a Fortigate firewall with a PaloAlto. With Fortigate firewall the problem did not exists, like PaloAlto without offloading enabled. This facts let us think it is a PaloAlto issue on his session hardware acceleration but only on this client, because we are not able to reproduce the scenario.
... View more
08-21-2012
01:19 AM
The packet is not dropped because when you use packet capture, you can choose different stages. If it was dropped it shoud appear in drop stage, and even if it is dropped or not it should appear on received stage and it does not appears in any stage. It only appears in received stage when I use no session offline. The PaloAlto has a permit any any any ... and both sides of traffic are in the same security zone. Also multicast is allowed (but it is not a multicast traffic). This case is only happening in one scenario. We tryed to reproduce it in a lab and we have not this problem.
... View more
08-20-2012
11:52 PM
I would mean, when I do a packet capture I do not see the kerberos pre-authentication packet, and If I do a port mirroring on the switch where is connected the PA or disabiling session offloading and lookin packet capture again, then I can see the kerberos pre-authentication packet. I have a case opened in PaloAlto support to solve this problem.
... View more
08-09-2012
04:45 AM
1 Kudo
disabling session offload, the packets are cached by PaloAlto device.
... View more
06-13-2012
01:15 AM
I have configured a destination to the ldap network with the Internal Source addres. Shuld I add a destination to host (maks 32) instead a destination to the network?
... View more
06-12-2012
02:44 AM
Hi, I have implemented a Palo Alto without Management interface, only an Inside interface/zone and Outside interface/zone. I configured the service route configuration to use Inside IP address for updates, dns... (all service routes). Also I have configured the network routing (all the networks that has to be accessed from Inside IP address. The problem is on ldap connection. When I configure the group mapping, I get an error because PaloAlto can not connect to ldap server. My tests: If I do a ping to ldap host, I get: From <management IP> icmp seq=X Destination host unrecheable. But If I do a ping with source Iniside IP address to ldap host I get response. admin@PA-500> show user group-mapping state all Group Mapping(vsys1, type: e-directory): LDAP_userauth Bind DN : cn=admin,o=esteve Base : ou=info,ou=intranet,o=esteve Group Filter: (None) User Filter: (None) Servers : configured 1 servers 172.20.0.181(636) Last Action Time: 50 secs ago(took 3 secs) Next Action Time: In 10 secs Last LDAP error: Can't contact LDAP server Number of Groups: 0 Could be that ldap connection is being started on management interface and the service routing for this service is not working? Regards,
... View more
06-06-2012
09:26 AM
I have mount a lab (DC - PaloAlto - Client), both on same zone and I got the same error. I tried without a explicit block roule and I tried with PanOS 4.0 and 4.1 with no success. We finally decide to open a case to PaloAlto. Regards,
... View more
06-01-2012
01:31 PM
I have a default block rule for log all traffic. I do not see any block between trust and trust zone. I can see ldap and kerberos application allowed. Also I can see ldap acctive sessions in the Session log. I configured the permit rule from/to trust zone. The Pc and DC are not in the same network, they are connected through layer 3 routing with static routes. In the past I had troubles with multicast, this traffic was not displayed on traffic logs. I thank join into windows 2008 domain could use multicast traffic but I did not see it on the sniffed traffic on PC. Regards,
... View more
06-01-2012
04:04 AM
Hi, I can not join into a domain when the computer pass through PA. This is my scennario: PC - PaloAlto - Switch - DomainController The PC and Domain controller are in the same Zone (trust) and I have a security rule: from zone trust, to zone trust, permit all. I can see a lot og kerberos v5 packet with bad checksum. Regards,
... View more
05-14-2012
12:42 AM
Hello Parth, Thank you for your advice. We did update the device to PANOS 4.0.11 and there is not any problem with VPN portal until today. Thank you again. Regards,
... View more
04-11-2012
08:13 AM
Hello, I have experimented the same issue on PanOS 4.0.9 in a PAN 2020. Hardware Pools [ 0] Packet Buffers : 57170/57344 0x8000000410000000 [ 1] Work Queue Entries : 192131/229376 0x8000000417000000 [ 2] Output Buffers : 999/1024 0x8000000418c00000 [ 3] DFA Result : 2048/2048 0x8000000419100000 DFA Result : [ 4] Timer Buffers : 4092/4096 0x8000000418d00000 Timer Buffers : [ 5] PAN_FPA_LWM_POOL : 8192/8192 0x8000000419300000 [ 6] PAN_FPA_ZIP_POOL : 1024/1024 0x8000000419500000 [ 7] PAN_FPA_BLAST_POOL : 64/64 0x8000000419700000 Software Pools [ 0] software packet buffer 0 : 1/16384 0x8000000021800680 [ 1] software packet buffer 1 : 1/8192 0x8000000022010700 [ 2] software packet buffer 2 : 1/8192 0x8000000022818780 [ 3] software packet buffer 3 : 1/4096 0x8000000023820800 [ 4] software packet buffer 4 : 1/256 0x800000002ba24880 [ 5] Pktlog logs : 10000/10000 0x800000002ca514e0 [ 6] Pktlog threats : 4999/5000 0x800000002cc6a720 [ 7] Pktlog packet : 5000/5000 0x800000002cd77080
... View more
01-24-2012
07:46 AM
Hi all, I solved the problem. When using ntp the time is not the same on all parts of PaloAlto device, I saw different time hours in log traffic (with the correct time), and log configuration (with a future hour). Setting the device time and date manually and then generating the certificates again, the problem was solved. Regards!
... View more
01-19-2012
05:51 AM
I installed the Root CA (I am using self signed certificate by PA device) on Trusted Root Certification Authorities but it still not working. Have I to install the Root CA in some other place? Thank you
... View more
01-19-2012
05:17 AM
I disabled the client cert on the Global Protect Portal and the error is the same. And the time and date of the client and PA is the same. Also certificates has valid date.
... View more
01-19-2012
04:20 AM
Hello, I configured the VPN-SSL on PANOS 4.1 using the "Configure Global Protect tech notes" document and the migration from Netconnect to Global Protect. Following these manuals I got this error. (T5448) 01/19/12 12:21:10:825 Debug( 392): CPanHTTPSession::PostRequest: WinHttpSendRequest... (T5448) 01/19/12 12:21:10:887 Error(4909): CPanMSService::GetWinHttpResponse: WinHttpSendRequest failed with error ERROR_WINHTTP_CLIENT_AUTH_CERT_NEEDED (T5448) 01/19/12 12:21:10:887 Debug( 392): CPanHTTPSession::PostRequest: WinHttpSendRequest... (T5448) 01/19/12 12:21:11:031 Error(8890): WINHTTP_CALLBACK_STATUS_FLAG_CERT_DATE_INVALID (T5448) 01/19/12 12:21:11:031 Error(4943): PostRequest failed with error code 12175. (T5448) 01/19/12 12:21:11:031 Debug(9420): Failed to pre-login to the portal 192.168.1.20. Error 12175 (T5448) 01/19/12 12:21:11:031 Debug(9461): close WinHttp close handle. (T5448) 01/19/12 12:21:11:031 Debug(5940): failed to get portal config from portal 192.168.1.20. Try to restore last portal config from file. I test some certificate configurations and I found using the web server certificate (the default certificate included on PanOS) as server certificate in Gateway Global Protect, the VPN is established. But If I used a CA signed certificate as is described on manuals, I got the last error message. I also tryed to use a new non CA signed certificate but I got the same error. Regards,
... View more
- Tags:
- ssl-vpn
Latest Blogs
Latest Posts
Copyright 2007 - 2020 - Palo Alto Networks
