About Dpeters1

Good Morning,   I'm lucky enough to work with a few early adopters and have PANOS8.0 running in several production locations on VM and 3000 series appliances.   So far, business as usual with the "old" feature set....   I've now setup Credential Protection on two of these sites, using the RODC method to spot username/password combos, rather than just username. The username only method seemed a little too wide a net to cast.   Anyway, it's up and running, but I was hoping some others may be running it too so we could compare notes?   My initial findings..   1) Obviously needs SSL inspection setup and working for all the URL categories you want to inspect for credentials 2) RODC's aren't that complex, but read the notes about groups allowed to sync to the RODC, if they dont sync, it wont work! 3) RODC's seem limited to 1500 sets of cached credentials? Interested in thoughts on how to scale out with domains with many 1000's of users 4) For my testing I used a domain account and typed those credentials into a variety of locations, facebook, linkedin, salesforce, google, outlook.com, several random websites. 5) Every single one was captured by the firewall 6) The continue page seems to use https://IPADDRESSOFWEBSITE:PORT/SOMEOTHERSTUFF, which causes an untrusted certificate error for the user 7) Block and Alert work fine 😎 in production (alert only) Had some false positives for google ads and some referal tracking links, checked with users who can be trusted and they are defintely NOT reusing corporate credetials. 9) Also had some false negatives in testing with the rest of the IT team, intentionally entering domain credentials into website and it doesnt catch them.   So in summary, looks VERY promising, but perhaps a few rough edges or some best practice guidance for reducing false positives would be very useful. I dont feel comfortable putting into full production with block pages just yet, but it is providing some useful information.   Over to you community! ... View more

Hi, I've recently seen this a couple of times on completely separate firewalls / AD infrastructures (a 2050 cluster and a 3020 cluster, both running 5.0.8). User ID is setup and working fine along with LDAP group mapping However on the odd occasion users report applications or URL categories blocked that should be allowed. It often "goes away" again soon. I spotted in the URL and Traffic logs, the user is (for short periods) identified just as USERNAME, rather than DOMAIN\USERNAME... This of course does not match rules with usernames specified in them. Any ideas why it may drop the domain name occasionally? Thanks Dave ... View more