About acamacho

I am going to assume that the licenses are updated. If not need to check that. Since you are using service routes the passive interface will not have any access out to the internet so even if you downloaded the seed file from our support site. The PAN needs to be able to go out and get updates as Brightcloud will always have latest update. If you can't use the mgmt port to get out to the internet then you will have always do a manual update. if you have further questions please let us know or call into support. thank you ... View more

The upgrade path to 5.08 from 4.0.12 If you have HA recommend that you upgrade the Passive first until you know that traffic passes and all features link VPN, IPsec in any works Export out your running-config.xml from the PAN so you have a backup in the event you need it. Download and do not install 4.1.0 Download and install 4.1.15 After the reboot and auto comm completes. From the Active device suspend so the passive takes over as the new active. Once you are sure all works then repeat on the active device. If you want to see what bugs and changes have gone into release 5.0.8 from the software link in the DEVICE TAB once you are running with 4.1.15 you should see the release notes. You can also log in to your support portal and under software you can download the release note from there. Hope this helps and if you like you're always welcome to call in for further assistance. Thank you ... View more

There are so many different items to look at if you want to know how to troubleshoot UserID issues. You can look in knowledge point for the specific issue you are facing. What is the actual issue you are facing.. Is it a user to ip mapping issue? Is it a LDAP group mapping issue? Your best bet might be to call into support or open a case so we can verify the issue that you are seeing. Thanks ... View more

Hello I just tested and it works from both Safiri and youtube app.. There could be may reasons, so if you have the time to call into support we can take a close look at counters. An any any policy moved to the top with source IP address of the ipad and no filtering should work. If not then we can assist over a web meeting. Thank you ... View more

This does sound like the version of User ID Agent is not supported. What version of PANos are you using? Can a 4.0.x device use the 4.1 user id agent? No. Can a 4.1 device use the 3.1.2 pan-agent? Yes. Hope this helps. ... View more

Hello It sounds like you have your configuration configured correctly, but without seeing only think I can recommend is the following. 1. Select the Network tab 2. Select the Zones link and make sure the zone that your clients connects has the Enable User Identification box checked. 3. Check the traffic log and see if your user name is being seen under the source user column. If you have time during your local business day maybe you can call into support so we can assist. Thank you ... View more

Hi Let me see if I can find the information but in the meantime here is a link that you can also review. https://live.paloaltonetworks.com/docs/DOC-1877 https://live.paloaltonetworks.com/docs/DOC-1936 ... View more

Please add another snap shot of the traffic log that shows the either screen.. need to see if you are hitting the same rules for the users that are not be identified. Also click on the detail icon.. Far left the one with the box and magnifying glass and add that snap shot too. If you have time as well maybe calling into support will help so we can look at it closer. thank you Al ... View more

You can also try and open up a security policy and specify the source IP of the test host pc. Create an any any policy without any scan profiles as well. Move the policy to the top. If this works then review the existing policy to see if the application or scan profiles might be preventing the traffic from being identified. If this still does not work you might want to call into support or your local reseller for assistance. Thank you ... View more

If the information provided is still not clear then you might want to call into support because there are so many different ways to generate reports. This way you can explain what you are trying to do and we can see setup a web meeting to assist.  ... View more

The Hello Interval is the time interval between heartbeat packets that are sent to verify that the opposing firewall is operational. The minimum value for hello interval is 1000 milliseconds (1 second) on the PA-4000 series, and 8000 milliseconds on the PA-2000 series. Setting the value to the minimum is recommended to achieve optimal failover times. When there is a loss of 3 hello messages the adjacent firewall is declared to be down and the passive device will become active See https://live.paloaltonetworks.com/docs/DOC-1094 which was recommended in an earlier post. ... View more

repeating what sjamaluddin stated there is no known limit for the number of groups a user can belong to. Here is a paltform capacity for User ID Agent Maximum number of pan-agents per vsys: 100 Maximum number of pan-agents per platform: 100 Maximum number of groups that can be defined in policies per vsys: 640 If you need additonal informaiton please contact support or local SE for additional information. ... View more

Hi When it comes to having dual ethernet PAN-Agent/User ID should keep a record of both IP addresses for the same user. If you see both user name on the same IP then that is a problem. Also if you have multiple user agents running please check to see if you are seeing both or just 1 IP address on the agents. Anyway I think you might be running into some issue that I have not seen, so if you can please do call into support so we can assist and look over your configuration to determine why you are seeing this. Thank you ... View more

Hello I have looked over our bug database and knowledge piont found no similar reported issue. If you can upgrade to PANos 4.1.3 and see if this fixes this or please open up a case with support so we can assist in investigating this. Thank  you Al ... View more

Hi There could be a fill reason why this happen, so I would recommend that you please open a case with support so we can assist with this. Unsually the procedure we provide the customer is to only download 4.10 and DO NOT install the PANos. Then you can download 4.1.4 and install it. Thanks Al ... View more

Yes the passwords are hashed on the config file. I have not heard of any case where someone has every decrypted the password or keys. Below is a password policy document that might assist with  your question. Al Re: Password Policy Hello, This option is available by enabling FIPS mode (FIPS 140-2) on the FW, though the following options will also apply: Federal Information Processing Standards Support: • To log into the firewall, the browser must be TLS 1.0 compatible. • All passwords on the firewall must be at least six characters. • Accounts are locked after the number of failed attempts that is configured on theDevice > Setup > Management page. If the firewall is not in FIPS mode, it can be configured so that it never locks out; however in FIPS mode, and lockout time is required. • The firewall automatically determines the appropriate level of self-testing and enforces the appropriate level of strength in encryption algorithms and cipher suites. • Non-FIPS approved algorithms are not decrypted and are thus ignored during decryption. • When configuring IPSec, a subset of the normally available cipher suites is available. • Self-generated and imported certificates must contain public keys that are 2048 bits (or more). • The serial port is disabled. • Telnet, TFTP, and HTTP management connections are unavailable. • Surf control is not supported. • High availability (HA) encryption is required. • PAP authentication is disabled.. Below is a Knowledgepoint Article regarding FIPS Mode: https://live.paloaltonetworks.com/docs/DOC-1536 FIPS mode (enabling/details) can be referenced as well via your Admin Guide. ... View more

Having a Digium PBX system behind a PAN should be supported. Are you having issues or about to install a PAN inline that has a Digium PBX? If  you are seeing issues you might have to create an application override for SIP and increase session timers. If you need assistance please call into support or contact local reseller for assistance. Thank you ... View more

This looks like some setting is missing or not completed when user was configuring ladp Look at these areas in the Device tab and verify that it's configured correctly and then try to commit again. 1. Server Profiles - LDAP 2. Authentication Profiles 3. Local User Database ... View more

Hello Apologies I did not realize that you already had cases open. I will follow up with the folks who are assigned these cases and we will get back to you. Thank you Al ... View more

Hello Please open a case or contact your local distributor to trouble shoot this issue. Thanks you ... View more

Hello I would recommend that you contact your local SE or distributor and have them go over were you should add the PAN devices. Thanks Al ... View more

1.  Does the device do any sort of reverse proxying for web servers?  OWA, Sharepoint? - I will have to get back to you on this one. 2. Can the Logs be configured to refresh any faster than 10 seconds.  My current firewall is at least one second.  Makes it nice to see when a bit of traffic hits the FW. - We only support 10sec, 30sec, 1min, and manual. 3. Can the device to HTTP to HTTPS redirection?  Enable users to type http and automatically be redirected to the actual https web page. - I will have to get back to you on this one. 4. Can the traffic logs be "colored" so that allowed rules appear as green , while blocked rules appear as red?  Or any color the admin wants... -This is not supported, but sounds like a good feature request. I would contact your SE so they can add this as a feature request to product marketing. 5. When creating RULES, searching for Applications can be trying.  I was interested in adding the HTTP protocol to a rule in the PAN but when I typed HTTP(or even “http”) into the Application search field all I got were items like http-audio, http-proxy, http-tunnel, http-video and httport.  I finally found the lowly HTTP protocol buried in a description for the Application called “web-browsing”.  Is there a better way to search for standard protocols for use in a rule? - This one again should also be a feature request. The device we are evaulating is curentlu using OS version 3.08, I believe.  Would the newest OS address any of the above issues? - The latest release would have the same results. ... View more

Hello At this point we might need to setup a web meeting so we can do more trouble shooting. Please let me if you are free on Monday and what time works. Thanks Al ... View more