About MikeC

MikeC · ‎10-04-2019

@OtakarKlier Yes, I meant to come back and delete the post. I was able to figure it out. I had to uncheck Log Container Page Only in my URL profile, to see the exact URL for aws. appreciate the reply though

MikeC · ‎10-04-2019

Is there any way to restrict amazon-cloud-drive-upload for certain websites? For example, say the website is www.mywebsite.com (public IP 1.1.1.1) and has an applet that allows users to upload files. When the user attempts to upload the files, the firewall detects this as application "amazon-cloud-drive-upload". You can't create a firewall rule that with a destination of 1.1.1.1 and allow app amazon-cloud-drive-upload , since that function is using amazon's IP address range (52.216.0.0/15). However, if you allow the application for that aws region, then these users can upload to any site that is in that region, which is not ideal. Hopefully, this makes sense

MikeC · ‎08-05-2019

@codyweber54 I decided to use the Windows User-ID agent instead. No more issues, since switching to that

MikeC · ‎05-24-2019

@kiwi I know but I went with 5.0.2 because of others informed me that a lot of bugs from 5.0.1 would be resolved in 5.0.2 @BPry So far it was only 2 users, one was windows 10 and the others windows 7. Both dell but different models. I have had many people successfully upgrade already. 5.0.2 has been working great for me so far

MikeC · ‎05-23-2019

Anyone experiencing any issues with GP 5.0.2? I started an upgrade this week. So far so good, but a few users experienced an odd issue during the upgrade. You'd click download, then when you click install, their screen went completely black. The upgrade completes successfully if you want it out but have to restart the explorer.exe process to get your desktop icons back

MikeC · ‎05-07-2019

@vsys_remo yes! I saw the email. I'll be installing it tomorrow too (for testing)

MikeC · ‎05-01-2019

thanks @cnygaard Sounds like I'll be waiting for 5.0.2. Right now, until I get the MFA vendor integration going, I use user certs as well as AD auth. Not sure if this is also a problem with 5.0.1, but I'll wait for 5.0.2 anyway 🙂

MikeC · ‎04-30-2019

@vsys_remo you have 10 open cases? Are you a palo employee? Thanks for the tip, I will wait a few days 🙂

MikeC · ‎04-30-2019

Thanks @vsys_remo I read this statement you made wrong " This feature also works with PAN-OS 8.0.x. With user-logon (as right now configured by @MikeC ) this is already possible with 4.1.x." I understand correctly now. I'm actually upgrading to 5.0.1 this week. Thanks so much

MikeC · ‎04-29-2019

thank you @hshawn and @vsys_remo So a few things, yes, currently it easy to circumvent, but most users don't know how to do that. The goal (for now) is for all internet traffic from corp devices to be full tunnel for inspection We are also looking at switching to pre-logon for other reasons. This may actually work out better. GP set to pre-logon, this will allow to internal resources, such as AD. Then, after user authenticates, they will be prompted for MFA from chosen provider (okta, duo, ping, etc)? The caveat being it has to be PAN OS9. Until firewalls are upgraded to os9, we can use this user-logon with the exception that you can't enforce gp for connectivity Do I have this correct?

MikeC · ‎04-29-2019

I was wondering if anyone here using GlobalProtect with MFA, such as Duo, Okta or Ping. Currently, clients portal app is set to User-Logon (Always On). I'd like to implement MFA for GP, but also keeping the always on functionality. The question is if the user does not enter their OTP, then GP will not connect. This would circumvent the always on functionality. There is the option (currently disabled) to "Enforce GlobalProtect Connection for Network Access". With this option set to yes, it should prevent someone from circumventing the VPN connection. However, what about when the user is in a hotel or using public wifi and needs to access to accept terms and conditions before wireless connection is established?

MikeC · ‎03-17-2019

@BPry @Raido Maybe another option that makes more sense is to switch from legacy mode to panorama mode? Do you see any downsides to doing this?

MikeC · ‎03-17-2019

Hi @BPry , Yes, this is the confusing part. This is the same link that I discussed with support. it sounded like it can be done, however, support said this option is only used if I were to deploy a new Panorama. The way it was explained was, setup a new Panorama VM and then we can copy the old logs to new Panorama. I should probably escalate the case.

MikeC · ‎03-15-2019

thanks. I was already aware of this one. I was wondering if it's possible to increase the space without deploying a new panorama

MikeC · ‎03-14-2019

I currently have a virtual Panorama on esxi running version 8.1.x in legacy mode. The VM is configured with a system disk and an additional 500GB disk for logging. The 500GB is proving to be not enough as I'm only able to keep a little of 1 month of logs. I have asked this question to support, but could not really get a clear answer. Is it possible to shut down panorama and expand the existing 500GB disk to 2TB? Not sure if Panorama will recognize the unallocated space when the VM powers back on. If this not an option, what is suggested? Should I convert from legacy to panorama mode? I'm still trying to read the caveats of doing that. I'd prefer not to lose any of the existing logs

MikeC · ‎02-22-2019

Hi, Not to deny. In my situation, I always block uploads with a File Blocking policy. What I needed was to allow uploads for only wetransfer. Since PAN was seeing the wetransfer upload traffic as application 'ssl', I need to add these urls to allow uploading only for wetransfer If you typically allow uploading and want to only block wetransfer uploads, then yes, you can use deny action

MikeC · ‎01-16-2019

I got it working, Would be nice to decrypt the web dropbox traffic but not decrypt from the client. I tried excluding just client.dropbox.com but that didn't work. The below got me what I needed Custom URL category for the below and don't decrypt that. *.dropbox.com dropbox.com/*

MikeC · ‎01-15-2019

I have a policy rule to allow dropbox. I am performing SSL Decryption. The users are using the dropbox client (not web). I came across this article that mentions this will not work when decrpytion is on https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGaCAK Anyone have recommendations on how to exclude the dropbox client traffic?

MikeC · ‎01-14-2019

I have Cisco WLC and use ACS for radius authentication. I'm trying to configure PA FW to use those accounting logs for User ID. I'm following this article but it's not working https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm8DCAS Where it says, " Give the target a name and enter the IP address of the interface that will process the Syslog and use port 514". They are referring to the Management interface, correct? When I run cli command, show user server-monitor state <Monitored server name> The number of logs increases, but the number of auth success messages stay at 0. I'm using ACS 5.8, PAN 8.1.4 and Cisco WLC

MikeC · ‎01-10-2019

Thank you both!

MikeC · ‎01-10-2019

@vsys_remo wrote: Do they authenticate in your wireless with their company credentials maybe with the authentication happening on a radius server? If yes, then use these logs for User-ID mapping. If thats not the case then you need to make sure that you configure enough sources for user-ID like active-directory, exchange ... to make sure that the time without mappkng is as short as possible. Yes! That's what I was just thinking. I'm using Cisco ACS for Radius auth. Is it pretty straight forward?

MikeC · ‎01-10-2019

A lot of my users login into their computers using the wired connection. Then when they are off to meetings, they switch to wireless (without logging out and logging back in). If I turn off client probing, this creates an issue where they switch to wireless, as the ID never seems to map. Is there a way to correct this? FYI....network bridging is disabled currently, so when they are wired, their wireless connection is automatically disabled

MikeC · ‎01-10-2019

@reaper wrote: You'd need to investigate logs on your ADs to make sure but it sounds like some of the WMI arentimjngnout which could be a sign that the AD are not keeping up with the amount of requests coming from the firewalls If the volume is unusually high you could also look into why this is: maybe a zone that does not have mapped IPs does have user-id enabled which will trigger a query for each unidentified IP (user-id only needs to be enabled on the 'source' zone of the identified users) I think you may be on to something here, even though I keep being told no. There is only 1 Trust zone on most of the firewalls, but there a few subnets where a user will never map. I think it can benefit from those subnets being excluded

MikeC · ‎01-10-2019

I agree, but I don't find 20 firewalls to be a lot. Is this too much for agentless user-ID?

MikeC · ‎01-09-2019

Has anyone experienced numerous of these "connect-server-monitor-failure" alerts when using agentless user ID? I have 20+ firewalls using a few specific domain controllers to get user ID info, but these alerts are constantly, 100's an hour. It seems to be related to WMI memory error, but I've already increased the wmi memory, described in this article https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CltXCAS DCs are Win2k8 R2

MikeC · ‎12-31-2018

thanks for the reply. Definitely not sinkholed. I will need to check if the new secondary DNS server (internal) is being sent requests. Are we saying if ComputerA tries to reach Primary DNS Server and for whatever reason can't reach it, it will then use Secondary DNS server and will never try to use Primary DNS until that service is restarted???

MikeC · ‎12-28-2018

When it was happening, the IT Support staff would restart their computers and that would resolve the issue. It was very random, such as 1 person would be fine, but the person next to them wouldn't be.

MikeC · ‎12-28-2018

Hi All, Awhile back I was having an issue using DHCP on our PAN Fws. In the DHCP options, if I set the primary DNS to an internal DNS server and the secondary to a public DNS server, our clients randomly had issues accessing internal resources. I would notice even though they had connectivity to the internal server, it was using the secondary to resolve internal systems. The internal dns servers are reached over VPN tunnels. To resolve the issue, I set both to internal dns servers. If the VPN tunnel goes down (it shouldn't), those clients in the branch offices will lose internet access since they no longer have a public DNS server as a secondary. Has anyone had similar experiences or have advice on this?

MikeC · ‎11-12-2018

@BPry is there a knowledge base document for this? That would be helpful to show management

MikeC · ‎11-12-2018

@BPry Maybe in the OP case that's what was done. In my case, the TAC engineer never even asked what type of firewalls I have. I have a mix of 200,820 and 3020's. It seems TAC needs to be trained, Palo is slipping a little bit lately. My co-worker called first, was told same exact thing as OP. I said that's incorrect and described the way you suggested, so I said, let's call back. We called back together, and again TAC said only thing needed is download 8.1.0 and install 8.1.4

Date Registered	‎08-12-2016 06:17 PM
Date Last Visited	Tuesday
Total Messages Posted	41
Total Likes Received	4

Online Status	Offline
Date Last Visited	Tuesday

Enterprise

Prisma

Cortex

About MikeC