About rmonvon

rmonvon · ‎11-16-2016

Hi...How about cloning the objects from shared & vsys2 into vsys1 so that all objects would be in vsys1? Then migrate vsys1.

rmonvon · ‎11-16-2016

Hi...When you have 2 M100s in HA, you can define both M100s to act as log collectors. The managed devices will forward logs to either one per your configuration. Let's say you have 6 managed devices/PAs on your network. You can have devices 1,2,3 forward to M-100-A while devices 4,5,6 forward their logs to M-100-B.

rmonvon · ‎11-07-2016

Hi...You need to change the Admin type from Dynamic to 'Device Group and Template Admin' and restrict the admin to the VSYS. Thanks.

rmonvon · ‎11-07-2016

Hi...You can view the config changes in Panorama under Monitor tab --> Logs --> Configuration. The events will have the before and after changes including the admin name who made the change.

rmonvon · ‎11-07-2016

Both options should work and you can choose 1.

rmonvon · ‎11-01-2016

Hi...The security rule is post-NAT so you should use the zones where the actual client/server lives. Here's a NAT doc for reference: https://live.paloaltonetworks.com/t5/Tech-Note-Articles/Understanding-PAN-OS-NAT/ta-p/60965?attachment-id=1707 The way I use to remember which zone to use for NAT is: - write the security & NAT rule using the zones where the client & server actually live. - If this is a dest NAT, then use the zone of the actual client as the source & dest zones in the NAT rule only, not security rule. Security rule will stay the same as described in previous step

rmonvon · ‎11-01-2016

Hi...How much virtual storage did you allocate to the VM? I would check that storage, install Panorama onto the VM, then import the configuration obtained from the M100.

rmonvon · ‎11-01-2016

Yes, you can use different IP such as a loopback IP. The IP should be assigned to the external zone & reachable from the external side.

rmonvon · ‎07-06-2016

I meant to logoff from your PC & logon again from your PC, not logging off the DC servers. Basically we want to simulate a user logging into your AD domain and one of your DC should record the logon event. If the DC record the event, then the agent should pick up that user-IP mapping.

rmonvon · ‎07-06-2016

I would recommend checking out the 2 DCs and understand why there were only 5 event ID 4769. Maybe you can test by logging off windows and logging back in to generate a login event. Verify that your login event is picked up by 1 of the 2 DCs. Do you have other DCs on the network that users may be loggin into but not monitored by the userID agent?

rmonvon · ‎07-06-2016

Hi...The agent's log shows that the agent is reading the security log of adserver.test.domain.com and dserver2.test.domain.com so the access permission is ok. Can you query the security logs on the DCs to see if the DCs are set up to log logon events IDs 4624, 4768, 4769, 4770, 540, 672, 673, 674? The agent is looking for these events.

rmonvon · ‎07-05-2016

Hi...Policies from Panorama must be committed to both active & passive HA devices. The HA's config sync is for local policies only and does not apply for Panorama shared policies. One purpose is the admin may commit Panorama changes to the active device and accidentally lock himself out. By having the passive remains unaffected, the admin can switch to the passive and correct the issue. Thanks.

rmonvon · ‎07-05-2016

Humm, that is odd. Any chance you can try the onbox agent on the PA or spinning a new agent on another Win server? Or try a different release 6.x or 7.x agent?

rmonvon · ‎07-01-2016

Hi...Do the userID agents have the same name? For overlapping settings, the top template will be used.

rmonvon · ‎07-01-2016

{edit] There is no comma after the IP address, and we specify the address delimiter has a comma. Can you add another syslog field after the IP address to get the comma into the syslog message? Other than that, I can't see anything wrong with your setup. The syslog messages match against the fields & delimiters. I would check the agent itself. Restart the agent & maybe re-install agent. Or just install another version of the agent on another server as a test. Open a support case & have it diagnose is another option. Thanks.

rmonvon · ‎06-28-2016

Can you take a screenshot of the syslog field settings on the PA and post it here? Also, do you have a syslog server like Kiwi syslog server that you can point the BlueCoat to? We want to confirm the exact syslog output that is being forwarded.

rmonvon · ‎06-28-2016

Can you instruct the BlueCoat to separate the fields with a comma or semi-colon? Then change the setting on the PA to match the delimiter: Username Delimeter: , Address Delimeter: , I think the \s is used for regex matching whereas the field match is an exact match and the PA was trying to match \s exactly.

rmonvon · ‎06-14-2016

From the rule screenshot, FTP should match 1st rule and not the 2nd rule as you pointed out. Did you happen to add/modify the FTP rules during the time period in question? If so, it may be that the FTP session matched 1 rule and a rule change occurred afterward which would not take effect on the existing FTP session. If you're still seeing this behavior where FTP is matching rule2, I recommend opening a Support cast to have it diagnose. Thanks.

rmonvon · ‎06-14-2016

Yes, we can use pre-logon but FRG would still need to decide if alway-on mode is acceptable.

rmonvon · ‎06-14-2016

Hi...If I understand you correctly, the server LAN will connect to a layer3 Eth port of the PA. The mobile users are crossing the vwire of the PA to reach the server LAN. Several options are available and it boils down to having 2 layer3 interfaces to route traffic from users to servers. You can create 2 L3 sub-interfaces on the layer3 port and police traffic between the 2 sub-interfaces (i.e. 1 sub-int for users & 1 sub-int for servers). Or define 2 physical L3 Eth ports to control traffic between them. You wouldn't need the virtual wire anymore. Thanks.

rmonvon · ‎06-14-2016

Can you take a screensot of the 2 FTP rules so we can see them please. Thanks.

rmonvon · ‎06-14-2016

You can set up the GlobalProtect VPN client to connect automatically whenever connectivity is available without human intervention. The VPN connection would remain active & connected though. If you want the VPN to connect when there is certain traffic present (i.e. traffic to 10.10.10.x/24) , you will need to use site-2-site VPN which requires a PA firewall on both ends.

rmonvon · ‎06-13-2016

The PA is getting UserID info, that's good. Can you check: 1 - the security zone(s) and make sure the zone for the internal network (where users live) have UserID option enabled. 2 - Make sure the source user column is active Thanks,

rmonvon · ‎06-13-2016

Hi...Are you seeing any userID entries when you issue CLI command ' show user ip-user-mapping all'? If no entries, then the issue is between the agent and the PA. Otherwise, we would need to check the PA - itsconfig, display option of monitor, etc.

rmonvon · ‎06-13-2016

Here's an updated list (11/30/2015) that is maintained by Palo Alto: https://live.paloaltonetworks.com/t5/Operations-Documentation/810-000077-00K-Reference-PAN-HW-Accessory-Cross-Ref-amp-RoHS/ta-p/63422 Thanks.

rmonvon · ‎06-13-2016

Hi...The GP client can be configured to automatically discover the closest GP gateway and connect to the gateway. It is one of the features of Global Protect. Is that what you're looking for?

rmonvon · ‎06-13-2016

Hi...That list should be applicable to all PA-3000s and cover the PA-3050. Thanks.

rmonvon · ‎06-13-2016

Hi...Load sharing of ECMP on the Palo Alto currently does not take into account real-time bandwidth use. Using 'balanced round robin' will distribute equal session between ECMP paths and path 2 will continue to take every other session. Thanks.

rmonvon · ‎05-26-2016

Hi...You may want to try running a User Activity Report on your IP and select 'Include Detailed Browsing'. It will contain timestamps and browse time for that user. As for logging on all categories, that should not impact the PA by much. I would recommend not logging CDN & web-ads categories since those may fill up storage, unless you really want to log those categories. Thanks.

rmonvon · ‎05-23-2016

Hi...By default, the traffic log is showing only the last X number of lines of recent logs and maybe those logs do not have a source user? If you scroll to the next page(s), do you see the source users? To verify if the PA has userID information, you can issue this CLI command: admin@pa200> show user ip-user-mapping all This userID information is applied to all traffic and is used to record logs. Thanks.

Date Registered	‎09-10-2009 08:10 AM
Date Last Visited	‎12-21-2016 06:18 PM
Total Messages Posted	708
Total Likes Received	186

Online Status	Offline
Date Last Visited	‎12-21-2016 06:18 PM

Strata

Prisma

Cortex

About rmonvon