About david_rivas1

david_rivas1 · ‎10-24-2012

The machines of these users are not in domain. That is the reason I used a script (obtain mapping from wireless controller) to send this mapping to the User-ID-Agent. Maybe these users use local admin account for some applications, but I have not configured admin ignoration.

david_rivas1 · ‎10-23-2012

I tied it without success. That is strange, why I get user ip-mapping throught CLI but it is only shown in some traffic logs. :smileyconfused:

david_rivas1 · ‎10-22-2012

Hello, I have developed a script that collects user-ip mapping from a wireless controller and send this info to User-ID Agent. All these looks fine because I can see the users in the User-ID Agent monitor table, but when I look traffic logs on Palo Alto I can see some logs do not have a user identification and other logs have it, for the same source IP. I attach a screenshot where you can see what I am trying to explain :smileysilly:. The user-ip mapping is correctly catched by PaloAlto. admin@PA-500> show user ip-user-mapping ip 172.21.8.195 IP address: 172.21.8.195 User: alumnes\zwillis Ident. By: AD Idle Timeout: 3581s Max. TTL: 3581s Groups that the user belongs to (used in policy) Does anyone knows what could be happening? Cheers,

david_rivas1 · ‎08-21-2012

Hello mikand, In my wireshark capture (done using port mirroring in the switch) any packet does not show bad checksum error. When I disable offloading the packet hit the received stage and pass through firewall and users complete the pre-authentication. This case has appeared when I tried to change a Fortigate firewall with a PaloAlto. With Fortigate firewall the problem did not exists, like PaloAlto without offloading enabled. This facts let us think it is a PaloAlto issue on his session hardware acceleration but only on this client, because we are not able to reproduce the scenario.

david_rivas1 · ‎08-21-2012

The packet is not dropped because when you use packet capture, you can choose different stages. If it was dropped it shoud appear in drop stage, and even if it is dropped or not it should appear on received stage and it does not appears in any stage. It only appears in received stage when I use no session offline. The PaloAlto has a permit any any any ... and both sides of traffic are in the same security zone. Also multicast is allowed (but it is not a multicast traffic). This case is only happening in one scenario. We tryed to reproduce it in a lab and we have not this problem.

david_rivas1 · ‎08-20-2012

I would mean, when I do a packet capture I do not see the kerberos pre-authentication packet, and If I do a port mirroring on the switch where is connected the PA or disabiling session offloading and lookin packet capture again, then I can see the kerberos pre-authentication packet. I have a case opened in PaloAlto support to solve this problem.

david_rivas1 · ‎08-09-2012

disabling session offload, the packets are cached by PaloAlto device.

david_rivas1 · ‎06-13-2012

I have configured a destination to the ldap network with the Internal Source addres. Shuld I add a destination to host (maks 32) instead a destination to the network?

david_rivas1 · ‎06-12-2012

I have done a packet capture and I see netbios packets dropped.

david_rivas1 · ‎06-12-2012

Hi, I have implemented a Palo Alto without Management interface, only an Inside interface/zone and Outside interface/zone. I configured the service route configuration to use Inside IP address for updates, dns... (all service routes). Also I have configured the network routing (all the networks that has to be accessed from Inside IP address. The problem is on ldap connection. When I configure the group mapping, I get an error because PaloAlto can not connect to ldap server. My tests: If I do a ping to ldap host, I get: From <management IP> icmp seq=X Destination host unrecheable. But If I do a ping with source Iniside IP address to ldap host I get response. admin@PA-500> show user group-mapping state all Group Mapping(vsys1, type: e-directory): LDAP_userauth Bind DN : cn=admin,o=esteve Base : ou=info,ou=intranet,o=esteve Group Filter: (None) User Filter: (None) Servers : configured 1 servers 172.20.0.181(636) Last Action Time: 50 secs ago(took 3 secs) Next Action Time: In 10 secs Last LDAP error: Can't contact LDAP server Number of Groups: 0 Could be that ldap connection is being started on management interface and the service routing for this service is not working? Regards,

david_rivas1 · ‎06-06-2012

I have mount a lab (DC - PaloAlto - Client), both on same zone and I got the same error. I tried without a explicit block roule and I tried with PanOS 4.0 and 4.1 with no success. We finally decide to open a case to PaloAlto. Regards,

david_rivas1 · ‎06-01-2012

I have a default block rule for log all traffic. I do not see any block between trust and trust zone. I can see ldap and kerberos application allowed. Also I can see ldap acctive sessions in the Session log. I configured the permit rule from/to trust zone. The Pc and DC are not in the same network, they are connected through layer 3 routing with static routes. In the past I had troubles with multicast, this traffic was not displayed on traffic logs. I thank join into windows 2008 domain could use multicast traffic but I did not see it on the sniffed traffic on PC. Regards,

david_rivas1 · ‎06-01-2012

Hi, I can not join into a domain when the computer pass through PA. This is my scennario: PC - PaloAlto - Switch - DomainController The PC and Domain controller are in the same Zone (trust) and I have a security rule: from zone trust, to zone trust, permit all. I can see a lot og kerberos v5 packet with bad checksum. Regards,

david_rivas1 · ‎05-14-2012

Hello Parth, Thank you for your advice. We did update the device to PANOS 4.0.11 and there is not any problem with VPN portal until today. Thank you again. Regards,

david_rivas1 · ‎04-11-2012

Hello, I have experimented the same issue on PanOS 4.0.9 in a PAN 2020. Hardware Pools [ 0] Packet Buffers : 57170/57344 0x8000000410000000 [ 1] Work Queue Entries : 192131/229376 0x8000000417000000 [ 2] Output Buffers : 999/1024 0x8000000418c00000 [ 3] DFA Result : 2048/2048 0x8000000419100000 DFA Result : [ 4] Timer Buffers : 4092/4096 0x8000000418d00000 Timer Buffers : [ 5] PAN_FPA_LWM_POOL : 8192/8192 0x8000000419300000 [ 6] PAN_FPA_ZIP_POOL : 1024/1024 0x8000000419500000 [ 7] PAN_FPA_BLAST_POOL : 64/64 0x8000000419700000 Software Pools [ 0] software packet buffer 0 : 1/16384 0x8000000021800680 [ 1] software packet buffer 1 : 1/8192 0x8000000022010700 [ 2] software packet buffer 2 : 1/8192 0x8000000022818780 [ 3] software packet buffer 3 : 1/4096 0x8000000023820800 [ 4] software packet buffer 4 : 1/256 0x800000002ba24880 [ 5] Pktlog logs : 10000/10000 0x800000002ca514e0 [ 6] Pktlog threats : 4999/5000 0x800000002cc6a720 [ 7] Pktlog packet : 5000/5000 0x800000002cd77080

Member Since	‎01-12-2012 01:11 AM
Date Last Visited	‎08-18-2015 09:07 AM
Posts	19
Total Likes Received	1

Online Status	Offline
Date Last Visited	‎08-18-2015 09:07 AM

About david_rivas1

Re: Source user not shown in some logs

Re: Source user not shown in some logs

Source user not shown in some logs

Re: Pc does not join into Domain

Re: Pc does not join into Domain

Re: Pc does not join into Domain

Re: Source user not shown in some logs

Re: Source user not shown in some logs

Source user not shown in some logs

Re: Pc does not join into Domain

Re: Pc does not join into Domain

Re: Pc does not join into Domain

Re: Pc does not join into Domain

Re: Service route for ldap

Re: Pc does not join into Domain

Service route for ldap

Re: Pc does not join into Domain

Re: Pc does not join into Domain

Pc does not join into Domain

Re: SSL-VPN Portal not showing

Re: SSL-VPN Portal not showing

Network Security

Cloud Security

Security Operations

About david_rivas1