About steve.chupack

I believe this is working in 5.0.4 without decryption. I have a single policy that permits the ftp and ssl applications to my IIS7 FTP server. At first I thought I'd made a mistake, so I checked the following: 1)  Is the ftp server allowing unencrypted traffic? Tested: No (it will not accept regular FTP connections) 2)  Is my policy erroneously allowing ALL traffic? Tested: No 3)  Is only the control channel encrypted and data is unencrypted? I wiresharked my traffic while transferring an ASCII file, and the data stream definitely looks encrypted. That and IIS is configured to encrypt both. Can anyone confirm that recent firmware does indeed "understand" the FTPS protocol when you specify both ftp and ssl as permitted applications? ... View more

So just to be clear, this issue is specific to configurations using the external userID agent? I.e., the service that I'm running on my DCs?  I can't really switch to agent-less, which I assume means the settings in the Device --> User Identification --> User Mapping tab, as I need to parse Exchange logs. But if someone could clarify, that would be helpful for my own edification. ... View more

I can get the management backplane to calm down a bit by restarting useridd via the following command: debug software restart user-id Unsure how long it takes for useridd to get angry again after that. ... View more

Same issue here with 5.0.2 and PA 2050. top - 07:57:29 up 25 days, 11:10,  1 user,  load average: 12.15, 11.85, 11.66 Tasks: 105 total,   2 running, 102 sleeping,   1 stopped,   0 zombie Cpu(s): 32.3%us, 47.5%sy,  5.0%ni, 13.8%id,  0.8%wa,  0.1%hi,  0.4%si,  0.0%st Mem:    995872k total,   964828k used,    31044k free,    20132k buffers Swap:  2008084k total,   545768k used,  1462316k free,   535468k cached   PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND            1796       20   0  212m  73m  64m S  174  7.5   8106:37 useridd ... View more

I'm experiencing the same issue. "Cisco" IPSEC clients fail due to a rekey issue after about 3300 seconds. It's really a shame -- other than the timeout issue, they work perfectly and provide nearly universal cross-platform compatibility. I may be upgrading to 5.x soon to address an unrelated user-id issue. I will post back to this thread if 5.x fixes it. ... View more

Bump. Same problem here, PA-2050, version 4.1.9. I have tried all the suggestions in the forum, but connections from Android and Linux devices timeout after about an hour. In the logs, I see this: IPSec key installed. Installed SA: 65.183.159.2[4500]-24.218.166.37[4500] SPI:0x8CB61A86/0x73498191 lifetime 3300 Sec lifesize unlimited followed by (surprise, surprise!) about 3300 seconds later.  😉      IKE phase-1 SA is expired SA: 65.183.159.2[4500]-24.218.166.37[4500] cookie:ffe6e33d5c27a2f5:6253cd787672d842. This is really a shame, because the connection works flawlessly, but in our environment timing out and having to manually reconnect isn't going to fly. ... View more