About MelLi

Hi Migration,   This might help with answering your question: An HTTP request and a response constitute one transaction. A session could have one or more transactions.   Cheers, Mel ... View more

Hi Dburns, The commands works for my customer but after a while there are user entries showing XMLAPI again in the user id table. Customer confirmed they have removed the API setting. But will confirm with them again to see what exactly happend. Thanks for your comments. Cheers, Mel ... View more

Hi Wlitdeparment, We had a similar issue with the same error message seeing in the useridd.log. It turns out to be the setting of the user mapping was not correct. Please check your WMI authentication setting in user mapping, make sure the username and password is set correctly.' Cheers, Mel ... View more

Hi Guys, thanks for your reply. We did test to clear user information from mp and dp, but the users are still showing up in the user id table as XMLAPI. We have opened a support case with PA TAC. Will update once the true cause has been found. Thanks, Cheers, Mel ... View more

Hi Hardik, Do you have any suggestions for this OCSP error we are having? Thanks, Cheers, Mel ... View more

Hi Hardik, We were testing in the lab environment, where both firewalls are directly connected to the server. Is there any document we can follow to further troubleshoot this. I do have a doc file recording our settings for the OCSP, do you think I can send it to you and you can help us to verify the settings are 100% correct? Thanks, Cheers, Mel ... View more

Hi Filipe, I had the same issue as you did, have you fixed the error message you got? If you did, can you please share with me what are the fixes? Thanks, Cheers, Mel ... View more

Hi Jthakur, Thank you for your suggestions. But there is still no success from our end. Please find our amended config using Field Identifier rather than Regex, in addition another SNMP trap from our test machine. Mar  4 13:00:27 syslog1 snmptrapd[2559]: 2015-03-04 13:00:27 10.5.80.1(via UDP: [10.5.80.1]:1028->[10.5.80.47]:162) TRAP, SNMP v1, community public#012#011iso.3.6.1.4.1.14179.2.6.3 Enterprise Specific Trap (53) Uptime: 83 days, 4:06:36.07#012#011iso.3.6.1.4.1.14179.2.6.2.35.0 = Hex-STRING: F8 4F 57 A4 C2 B0 #011iso.3.6.1.4.1.14179.2.6.2.36.0 = INTEGER: 0#011iso.3.6.1.4.1.14179.2.6.2.43.0 = IpAddress: 10.5.185.2#011iso.3.6.1.4.1.14179.2.6.2.34.0 = Hex-STRING: E4 CE 8F 5B A5 54 #011iso.3.6.1.4.1.14179.2.6.2.39.0 = STRING: "test.staff"#011iso.3.6.1.4.1.14179.2.2.1.1.3.6.248.79.87.164.194.176 = STRING: "WAP-001” Doing a TCP dump, we can certainly verify that the PAN is receiving the messages. Is there any debugging commands we can use on the PAN to see whether the device is interpreting the messages correctly? We can see the below output from our PAN: Proxy: syslog1(vsys: vsys1)     Host: syslog1(10.5.80.47)         number of log messages                            : 75255         number of auth. success messages                  : 0 kris.kopicki@gw> show user server-monitor state syslog1         UDP Syslog Listener Service is enabled         SSL Syslog Listener Service is enabled Proxy: syslog1(vsys: vsys1)     Host: syslog1(10.5.80.47)         number of log messages                            : 75259         number of auth. success messages                  : 0 Have you got any suggestions? Should we open a support case for this? Thanks in advance. Cheers, Mel ... View more

Hi Jthakur, Thanks for your reply. Please find a sample of the data Feb 27 16:18:52 syslog1 snmptrapd[2559]: 2015-02-27 16:18:52 10.5.80.1(via UDP: [10.5.80.1]:1028->[10.5.80.47]:162) TRAP, SNMP v1, community public#012#011iso.3.6.1.4.1.14179.2.6.3 Enterprise Specific Trap (53) Uptime: 78 days, 7:24:55.14#012#011iso.3.6.1.4.1.14179.2.6.2.35.0 = Hex-STRING: F8 4F 57 A4 C2 B0 #011iso.3.6.1.4.1.14179.2.6.2.36.0 = INTEGER: 0#011iso.3.6.1.4.1.14179.2.6.2.43.0 = IpAddress: 10.5.185.5#011iso.3.6.1.4.1.14179.2.6.2.34.0 = Hex-STRING: D8 96 95 11 3D 8F #011iso.3.6.1.4.1.14179.2.6.2.39.0 = STRING: "sarah.harris"#011iso.3.6.1.4.1.14179.2.2.1.1.3.6.248.79.87.164.194.176 = STRING: "WAP-001” We have used the document https://live.paloaltonetworks.com/docs/DOC-8771 However,the date output is completely different between the WLC5500 and 3850. Is there any other document we can refer to? Thanks, Cheers, Mel ... View more

Hi, Can anyone please help to point me to the right direction? Thanks, ... View more

Hi Tijl, Thanks for your reply. The software version is 6.0.3. We assume this might be the certificate issue as once the website is added to bypass ssl decryption, and it works. Cheers, Mel ... View more

Hi emr, Thanks for the suggestion. But is it possible to request PA to add certain CA in the next release? Cheers, Peiyao ... View more

Thanks Hulk! Much appreciated. Cheers, Mel ... View more