About u2343

u2343 · ‎05-14-2012

Hi, I was wondering if there are any plans or a method how to detect Office 365 traffic? We have no URL scanning license on the box, so we depend on the App detection method. Because all traffic is a SSL connection, PaloAlto reports the traffic as general SSL Application. Many thanks for any suggestion about my issue.

u2343 · ‎04-21-2011

I have also the same problem. Using WIndows 7 with IE9. Maybe a browser issue. Is IE9 supported to manage the paloalto? Regards.

u2343 · ‎10-14-2010

I had the same problem. But there is a workaround for this. Put the account what is used for Run As in the text file ignore_user_list.txt This way the user in this text file will be ignored from detection through the security log. You can also create a AD group and put these users in it. Add to the ignore group filter. Works great for me!

u2343 · ‎05-07-2010

Hi, I have also delteted the logs on my standby box and still 38% CPU usage with 3-10 sessions and with very little or no traffic at all. I have used the clear log acc, config, system, threat and traffic. So it can't be the log conversion! Any help or ideas are welcome. We have no production problems currently but the high cpu usage is strange when you are used to use 10% max usage with 3.0.x versions. Regards, O. Bor

u2343 · ‎05-06-2010

Hi, Here also the same problem. High CPU usage on 2 PA2050 boxes. 1 Box is running now almost 1 week on 3.1.1 and still 38-50 % cpu usage. This is also the standby box, so there is little or no traffic on this system. Regards, O. Bor

u2343 · ‎03-12-2010

Hi, We have a forest domain with 2 child domains. Now I have 2 pan agents installed for both domains and it's working well. Now I have the following problem about wich groups to use. I must use 2 global groups to give users access through the firewall. A global Group from domain A and a Global Group from Domain B. So this means I must administer 2 groups in different domains. Normally in AD when you use a Domain Local group then you can put users from different domains in this group. I have done that so I have a Domain Local Group with users from Domain A and B and selected this group in the Policy but no success. Is it possible to use a domain Local group witch the User-ID feature? The wish is to administer 1 group instead of 2 groups from both domains. Many Thanks Osman Bor

u2343 · ‎01-06-2010

Thanks for the answer. This wil solve my problem. Also is there any documentation about the meaning of the other settings of the config.xml file? Regards, O. Bor

u2343 · ‎01-04-2010

Hi, I see in the logfile the information : 2010 01 04 10:07:25, ########################### Start Pan-Agent ############################# 2010 01 04 10:07:25, Add Domain: ce 2010 01 04 10:07:25, Num. of Threads: 40 2010 01 04 10:07:25, GroupMemebers cache flag is 1. 2010 01 04 10:07:25, Add DNS-style Domain: xxxxx.com 2010 01 04 10:07:25, Add NetBIOS Domain: xx 2010 01 04 10:07:25, Full expire is disabled. 2010 01 04 10:07:25, Max DC is 10. 2010 01 04 10:07:25, Check DC is disabled. 2010 01 04 10:07:25, Configured DC[1]: xxx.xxx.xxx.xxx 2010 01 04 10:07:25, Configured DC[2]: xxx.xxx.xxx.xxx 2010 01 04 10:07:25, Configured DC[3]: xxx.xxx.xxx.xxx 2010 01 04 10:07:25, Configured DC[4]: xxx.xxx.xxx.xxx 2010 01 04 10:07:25, Configured DC[5]: xxx.xxx.xxx.xxx 2010 01 04 10:07:25, Configured DC[6]: xxx.xxx.xxx.xxx 2010 01 04 10:07:25, Ip mapping cache is enabled. What does this mean? I have set the age-out timeout enabled and set for 45 min. But i experince that this is not working. I have disabled the netbios probing also. Regards, Osman Bor

u2343 · ‎10-30-2009

Thanks for your reply. It's only too bad that this can't be changed for the Captive Portal. I think it's have to do with security but maybe it's better to let it decide by the organization if it's acceptable security. Currently we are planning to move from a Cisco FW to the PaloAlto. And we are used to validate every 4 hours and it's very hard and impossible to sell this solution, that users need to logon every 15 min. with the PaloAlto. At this moment the project stopped because this is not accepted by the users group. So the Captive Portal is not a solution for us and we must try to find a way to use NTLM or AD with SSO. This way the users will not be prompt to logon. But this is very difficult to implement when you have mixed users in AD and not in AD. Captive portal was our fallback method. Regards, Osman Bor

u2343 · ‎10-29-2009

You can set the Timeout value of captive portal. Default is 60 min. In my case it is 240 min. But this is the max TTL. There is a default TTL of 900 sec(15min) So when a logged on user does not create any traffic for 15 min then the user must logon again. IP dent. By User TTL (s) Max. TTL (s) --------------- --------- -------------------------------- ------- ------------ 145.8.245.40 CP ce.altis.corusgroup.com\A193813 830 14327 Can the default ttl be changed? Realy i don't know why there are 2 setting for the timeout value!! Osman Bor Network Engineer. Corus group

Date Registered	‎09-07-2009 06:32 AM
Date Last Visited	‎08-18-2015 09:06 AM
Total Messages Posted	10
Total Likes Received	1

Online Status	Offline
Date Last Visited	‎08-18-2015 09:06 AM

About u2343

Office 365 App Detection

Re: Reason to upgrade to 4.0.2 ? ! ?

Re: User-ID and Windows "Run As"

Re: High CPU Usage on PANOS 3.1?

Re: High CPU Usage on PANOS 3.1?

Re: User-ID and Windows "Run As"

Office 365 App Detection

Re: Reason to upgrade to 4.0.2 ? ! ?

Re: User-ID and Windows "Run As"

Re: High CPU Usage on PANOS 3.1?

Re: High CPU Usage on PANOS 3.1?

PAN-Agent Multi Domain and Group membership

Re: Pan Agent Expire setting

Pan Agent Expire setting

Re: Captive Portal Session Timeout

Captive Portal Session Timeout

Strata

Prisma

Cortex

About u2343