About PSC_IT

PSC_IT · ‎12-11-2012

Is there an update for when this can be expected? Thanks.

PSC_IT · ‎08-02-2012

How would I go about creating a link aggregation from a Cisco Cat4500-series switch to a PA-5020? I'm shooting for having multiple links between the two devices for redundancy (and load-balancing too, if possible). What would I have to do on the Cisco side of the aggregated link? What about the PA-5020 side of the link?

PSC_IT · ‎07-05-2012

Thanks, I'm using the User-ID Agent version 4.1.4-3. I have both of those documents and looked through them, but didn't see anything about the group update rate. BUT, going back again, I see there was a small section about the update rate in the Upgrade Tech Notes and I guess I completely missed it. Oops. Anyways, thanks for the info....especially that CLI command since I have been using the web interface, I wouldn't have known about that CLI command.

PSC_IT · ‎07-05-2012

Thanks for the info. I am currently running version 4.1.6 on my Palo Alto firewall. I just changed the Update Interval to 60 seconds (the lowest possible value allowed) for the Group Mapping settings, so hopefully that will speed up the refresh process. One question about the method to force a refresh: What effect will this have on the Palo Alto and its functionality? Will it only affect the user-ID process, or are there any other side-effects? About how long does it take for the User-ID process to restart once the command is issued? And finally, is there a GUI version of the command or is it only CLI? Thanks again for the help.

PSC_IT · ‎07-02-2012

I'm using User-ID and Active Directory groups to identify traffic from specific people. The User-ID part seems to be working because Source User shows up in the logs and I can configure firewall rules using individual user-IDs. However, I'm having issues with the AD groups. The Palo Alto is able to pull existing groups from Active Directory and use those groups just fine. The problem is when I try to use newly created AD groups in any firewall rules--the newly created groups don't show up in the list of available users and groups when you click "Add" in the "Source User" field. After getting sidetracked with another issue, when I came back some of the newly created groups showed up, but not all of them and not the ones that I changed (I changed the name of one group, and when it showed up on the Palo Alto, it had the old name). My question(s) are: 1) Is there some kind of waiting period before the Palo Alto checks for new/changed AD groups? 2) Is there some way to force the Palo Alto to "refresh" its listing of AD groups? Thanks in advance for the help.

PSC_IT · ‎06-28-2012

True, I forgot about that part of Facebook....something for me to modify tomorrow :smileymischief:

PSC_IT · ‎06-28-2012

That's very true if you want to allow limited access to Facebook/Twitter (i.e. look, but don't post), but in my case, if the selected person is allowed access to Facebook/Twitter, they are given full access to the site (except for whatever doesn't work because I don't feel like fixing it--like the "Jabber" App-ID needed for facebook-chat ). If our agency's Internet usage policy were to change, I could very easily change from the Facebook App-ID to more specific App-IDs, such as Facebook-base, Facebook-post, etc....

PSC_IT · ‎06-28-2012

Hi Thaigo, I'm not using URL filtering to block Facebook and Twitter, I'm using the Facebook and Twitter App-IDs to allow specific people through. Everyone else hits the Deny All rule at the bottom. The URL filter is only for the web-browsing and SSL dependencies required for the Facebook and Twitter App-ID. Thanks

PSC_IT · ‎06-28-2012

Thaigo, In fact, that's what I tried at first. My very first attempt I had four rules, in the following order: Allow: Source: (My PC); Destination: (Any); App-ID: (facebook, twitter); URL-category: (Any) Deny: Source: (Any); Destination: (Any); App-ID: (facebook, twitter); URL-category: (Any) All Web-browsing: Source: (Any); Destination: (Any); App-ID: (web-browsing, SSL); URL-category: (Any) Profile: (URL Filter profile blocking "Social networking" category) Deny all: Source: (Any); Destination: (Any); App-ID (Any); URL-category: (Any) The problem is that before Facebook or Twitter (or many other applications) can be identified, they start out as basic "SSL" (for Facebook, "web-browsing" for Twitter) and as additional traffic is received, the Palo Alto gets enough traffic to identify the application traffic as Facebook or Twitter or whatever. So, the inital traffic (i.e. the first packet of the TCP connection) is classified with a "SSL" App-ID and hits rule #3, which has the URL filtering blocking social networking. Rule #3 will then block the inital Facebook/Twitter traffic, killing the connection before any further traffic is identified as Facebook/Twitter--Rules #2 and Rule #3 are never used. My original issue was that the Facebook and Twitter App-IDs needed "web-browsing" and "ssl" App-IDs to work, but adding those two dependent App-IDs would have allowed too much access for the selected Facebook and Twitter users. But adding the basic URL filter profile to restrict access would have stopped the Facebook and Twitter App-IDs from working. A little bit of a Catch-22 right there. The custom URL category allows me to have a second "web-browsing" and "ssl" rule that only applies to the specific users I am allowing access to Facebook and Twitter. Everyone else would hit the main "web-browsing" rule near the bottom of the policy list.

PSC_IT · ‎06-28-2012

As I was working on this earlier, I tried many different things and combinations of things, including adding more and more URLs to see if that helped or not. When I got things working, I did not go back and clean up the URLs I added (yet). Anyways, after some more trial and error (mostly error), here's the "clean" version of the custom URL category. Note that I removed the /* wildcard from the end of each URL--it seems to make everything work better. P.S. I forgot to mention that the Facebook App-ID complained about a dependency call "jabber" needed for Facebook-chat. I don't really care about the chat function in Facebook, so I probably won't put much effort in resolving this issue.

PSC_IT · ‎06-28-2012

I think I got it (finally) working. I'll have to do more testing to confirm that it does what I want without allowing something I don't want. Here's a screenshot of the firewall rules: I separated the rules into two parts. My thinking was that this way the rule "Twitter and Facebook 2" will only match traffic that is web-browsing AND fits the custom URL category I configured--nothing else. Also, another reason is that Facebook and Twitter pulls dynamic page contents from multiple URLs, which have different URLs (and URL categories)--all of which will automatically be allowed by the "Twitter and Facebook 1" rule because the only URLs (and URL categories) that will match that rule will have an App-ID of facebook or twitter, which is what I want. Also, here's a screenshot of the custom URL category. Some of the URLs maybe redundant and were added as I was initially testing this solution. I'll have to test some more to see what is needed and delete the extras. I hope that helps anyone else who is trying to do the same thing I am.......keeping in mind I'm still testing this solution And thanks again to sdurga for pointing me in the right direction.

PSC_IT · ‎06-26-2012

What's the best way to configure selective access to Facebook and Twitter (where some users have full access, while everyone else has no access). The sources will be identified by IP address for right now (usernames later when I get to that). So far, all my attempts using combinations of App-ID and URL Filtering Profiles have failed. I think the main thing that is giving me grief right now are the dependencies required for the App-IDs. The Facebook and Twitter App-IDs also need the "Web-Browsing" App-ID to be allow through, but this ends up giving the selected users too much access (because their web-browsing hits this rule instead of the main "Allow Web-Browsing Out" rule further down the list that contains the URL Filtering Profile). I need to have the URL Filtering Profiles on the "Allow Web-Browsing Out" rule to block access to other social networking sites and other URL categories. I've beening hitting my head against this brick wall for long enough.... Thanks in advance for the help.

Member Since	‎06-12-2012 02:35 PM
Date Last Visited	‎08-30-2017 01:39 PM
Posts	12
Total Likes Received	1

Online Status	Offline
Date Last Visited	‎08-30-2017 01:39 PM

About PSC_IT

Re: User-ID Agent on Windows Server 2012?

Link Aggregation to Cisco Switch

Re: AD Groups Not Showing Up

Re: AD Groups Not Showing Up

AD Groups Not Showing Up

Selective Access to Facebook and Twitter

Re: User-ID Agent on Windows Server 2012?

Link Aggregation to Cisco Switch

Re: AD Groups Not Showing Up

Re: AD Groups Not Showing Up

AD Groups Not Showing Up

Re: Selective Access to Facebook and Twitter

Re: Selective Access to Facebook and Twitter

Re: Selective Access to Facebook and Twitter

Re: Selective Access to Facebook and Twitter

Re: Selective Access to Facebook and Twitter

Re: Selective Access to Facebook and Twitter

Selective Access to Facebook and Twitter

Network Security

Cloud Security

Security Operations

About PSC_IT