This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
- Panorama
- AIOps for NGFW
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- Cloud NGFW for AWS
- CN-Series
- VM-Series:
- Private Cloud
- OCI
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
- Cortex Xpanse
Security Operations
- Resources
About rmonvon
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About rmonvon
12-21-2016
708Posts
187Likes
102Solutions
Dec 21, 2016Last Visited
User
Activity
User
Profile
Latest posts by rmonvon
| Subject | Views | Posted |
|---|---|---|
| 1389 | 11-16-2016 06:56 AM | |
| 1531 | 11-16-2016 06:51 AM | |
| 898 | 11-07-2016 07:46 AM | |
| 2886 | 11-07-2016 07:42 AM | |
| 1958 | 11-07-2016 07:28 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 05-16-2016 06:41 AM | |
| 1 Like | 02-27-2012 06:36 AM | |
| 1 Like | 11-07-2016 07:42 AM | |
| 1 Like | 11-01-2016 07:32 AM | |
| 1 Like | 11-01-2016 07:50 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like |
User Badges
Community Statistics
| Member Since | 09-10-2009 08:10 AM |
| Date Last Visited | 12-21-2016 06:18 PM |
| Posts | 708 |
| Total Likes Received | 186 |
11-16-2016
06:56 AM
Hi...How about cloning the objects from shared & vsys2 into vsys1 so that all objects would be in vsys1? Then migrate vsys1.
... View more
11-16-2016
06:51 AM
Hi...When you have 2 M100s in HA, you can define both M100s to act as log collectors. The managed devices will forward logs to either one per your configuration. Let's say you have 6 managed devices/PAs on your network. You can have devices 1,2,3 forward to M-100-A while devices 4,5,6 forward their logs to M-100-B.
... View more
11-07-2016
07:46 AM
Hi...You need to change the Admin type from Dynamic to 'Device Group and Template Admin' and restrict the admin to the VSYS. Thanks.
... View more
11-07-2016
07:42 AM
1 Kudo
Hi...You can view the config changes in Panorama under Monitor tab --> Logs --> Configuration. The events will have the before and after changes including the admin name who made the change.
... View more
11-01-2016
07:50 AM
1 Kudo
Hi...The security rule is post-NAT so you should use the zones where the actual client/server lives. Here's a NAT doc for reference: https://live.paloaltonetworks.com/t5/Tech-Note-Articles/Understanding-PAN-OS-NAT/ta-p/60965?attachment-id=1707 The way I use to remember which zone to use for NAT is: - write the security & NAT rule using the zones where the client & server actually live. - If this is a dest NAT, then use the zone of the actual client as the source & dest zones in the NAT rule only, not security rule. Security rule will stay the same as described in previous step
... View more
11-01-2016
07:38 AM
Hi...How much virtual storage did you allocate to the VM? I would check that storage, install Panorama onto the VM, then import the configuration obtained from the M100.
... View more
11-01-2016
07:32 AM
1 Kudo
Yes, you can use different IP such as a loopback IP. The IP should be assigned to the external zone & reachable from the external side.
... View more
07-06-2016
11:55 AM
I meant to logoff from your PC & logon again from your PC, not logging off the DC servers. Basically we want to simulate a user logging into your AD domain and one of your DC should record the logon event. If the DC record the event, then the agent should pick up that user-IP mapping.
... View more
07-06-2016
11:15 AM
1 Kudo
I would recommend checking out the 2 DCs and understand why there were only 5 event ID 4769. Maybe you can test by logging off windows and logging back in to generate a login event. Verify that your login event is picked up by 1 of the 2 DCs. Do you have other DCs on the network that users may be loggin into but not monitored by the userID agent?
... View more
07-06-2016
08:30 AM
1 Kudo
Hi...The agent's log shows that the agent is reading the security log of adserver.test.domain.com and dserver2.test.domain.com so the access permission is ok. Can you query the security logs on the DCs to see if the DCs are set up to log logon events IDs 4624, 4768, 4769, 4770, 540, 672, 673, 674? The agent is looking for these events.
... View more
07-05-2016
05:54 PM
3 Kudos
Hi...Policies from Panorama must be committed to both active & passive HA devices. The HA's config sync is for local policies only and does not apply for Panorama shared policies. One purpose is the admin may commit Panorama changes to the active device and accidentally lock himself out. By having the passive remains unaffected, the admin can switch to the passive and correct the issue. Thanks.
... View more
07-05-2016
07:32 AM
Humm, that is odd. Any chance you can try the onbox agent on the PA or spinning a new agent on another Win server? Or try a different release 6.x or 7.x agent?
... View more
07-01-2016
10:59 AM
Hi...Do the userID agents have the same name? For overlapping settings, the top template will be used.
... View more
07-01-2016
07:57 AM
{edit] There is no comma after the IP address, and we specify the address delimiter has a comma. Can you add another syslog field after the IP address to get the comma into the syslog message? Other than that, I can't see anything wrong with your setup. The syslog messages match against the fields & delimiters. I would check the agent itself. Restart the agent & maybe re-install agent. Or just install another version of the agent on another server as a test. Open a support case & have it diagnose is another option. Thanks.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
12-21-2016
06:18 PM
|
Latest Tags
No tags yet
Likes From
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks