About jnguyen

The domain controller must log “successful login” information. These are the event ids that pan-agent looks at: 2000 $ 2003 SUCCESS_NET_LOGON = 540, AUTH_TICKET_GRANTED = 672, SERVICE_TICKET_GRANTED = 673, TICKET_GRANTED_RENEW = 674, ACCOUNT_USED_FOR_LOGON = 680, 2008 LOGON_SUCCESS_W2008 = 4624, AUTH_TICKET_GRANTED_W2008 = 4768, SERVICE_TICKET_GRANTED = 4769, TICKET_GRANTED_RENEW_W2008 = 4770, ACCOUNT_USED_FOR_LOGON_W2008 = 4776, ... View more

I would suggest you open a case online and provide a tech support file for further debugging. ... View more

i would suggest creating a case for this issue. while you open a case if you enabled debugging on the web ui and replicate the issue this should provide us with some additional data. To turn on UI php.debug.log, http(s)://xxxx/debug then click on Debug button. ... View more

in the ldap server profile under device --> server profiles --> ldap did you enter in the domain in the domain field? example if your domain is abc.com. users are currently logging in via abc\user. you will need to enter abc in the domain field. ... View more

internal apps: This app is reported as bittorrent on the UI. This is what is going to happen for bittorrent: 1.       UDP sessions comes 2.      App id detects that it is bit-internal. It gets reported as bittorrent on UI 3.      App becomes bit-internal 4.      Bit-internal decoder runs 5.      It predicts TCP session 6.      It sets the app to bittorrent 7.      The session gets blocked if the action is deny for bittorrent 8.      TCP session arrives, and it becomes bittorrent, as expected ... View more

admin@PA-200> debug user-id > agent                          Debug agent > clear                          Clear data > dump                           Dump debug data > get                            Display current debug logging setting > log-ip-user-mapping            whether to generate logs for ip user mapping > off                            Turn off debug logging > on                             Turn on user-id debug logging > refresh                        Refresh data > reset                          Reset data > save                           Save data > set                            set > test                           test > unset                          unset > use-modify-for-group-mapping   whether to use modify timestamp in group mapping admin@PA-200> debug user-id refresh group-mapping all     ... View more

The reason of the error is similar since it relates to userid. can you open a case online and upload both tech support files for review. ... View more

could you provide the acutal message being sent. in 4.1.2 there will be a fix for a similar issue, but i wanted to make sure that the errors were the same. example: high userid HA-queu 0 HA queue is full in this case there was also userid deployed. what was happening here was that the passive device will receive data from the active device but not drain the queue after the data was received. ... View more

there should be no issues behind a proxy. note: GP client can detect and use IE’s proxy settings. If customer setup proxy through other browsers (e.g. Firefox), GP client won’t use it. ... View more

RSA SecurID Ready Implementation Guide https://live.paloaltonetworks.com/docs/DOC-1370 https://gallery.emc.com/docs/DOC-2151?viewTab=collateral&version=3 ... View more

what are you trying to capture in data filtering? ... View more

the User agent will need to read log files from each of the DC's since security logs are not sync'd between DCs. Over a wan link or a link which will have less bandwidth (remote site) i have seen where this communication can saturate the link. work around would to install agents in geo location. ... View more

is this a active / active ha set up or is this active passive. in active passive both devices should mirror each other. i know in active / active you will have slight differences in configuration which may cause this portion not to be sync'd. ... View more

If you would like for the juniper appliance to have a external IP address you will need to burn two additional ports on the palo alto. the two newly configured ports will be set up in vwire (bridge mode). you will also need a switch in front of the palo alto as well. one port will plug into an upstream switch were the public interface of the palo alto will also plug in and also the cable from the isp will need to plug into this switch. the other end of the vwire will plug into the juniper. you can also go another route with having the juniper a private ip address on the internal side of the palo alto and create a static nat on the palo to forward anything to that public ip to the juniper. https://live.paloaltonetworks.com/docs/DOC-1517 ... View more

I just check on another device and you are correct it can be vary on the application for url filtering logs. i was testing on a lab unit but only saw web-browsing. if you can log a case online we can have our content team look into this. ... View more

This should be expected behavior. the application in the url logs will be web-browsing. if you go to the traffic logs do you see youtube-base? ... View more

I would assume if the application does not show up as youtube it is either detected as web-browsing or ssl. Are you blocking your users from access to youtube and now it is allow access since the application is not detected? ... View more

Can you go more into detail about what you are trying to do with web services sdk? ... View more

We reviewed  your configuration and it looks ok. What we would like for for a debugging session if possible. what i recommend is to call into support and open a case with support to debug this issue further. ... View more