About bbilut

bbilut · ‎11-14-2018

Looks like the issue I was seeing was caused by Chrome, as I've verified I no longer experience the Palo Alto Block Page when my students do a search. I just uninstalled and verified Chrome: 69.0.3497.100 (and earlier) have no issues Chrome: 70.0.3538.67 - Safe search block page (even though safe search is forced on with GPO policy) Chrome: 70.0.3538.77 - Safe search block page (even though safe search is forced on with GPO policy) Chrome: 70.0.3538.102 - No issues

bbilut · ‎11-05-2018

I have not tested it with Firefox or IE... mainly because we have safe search enforcement set in Chrome via Windows Group Policy. Firefox, does not have really policy support, and I don't think the IE GPO has a setting for safe search enforcement. I can replicate this every time where it works fine in Chrome 69, and as soon as I upgrade to Chrome 70 the search always get blocked saying you have to turn on safe search (even though it's on via GPO). If I hit refresh or F5 at the block page the search will complete properly in (safe search mode).

bbilut · ‎10-31-2018

I'm having this same problem. We've been using Safe Search enforcement on the Palo and Safe Search policy via GPO for at least 4 years. I finally figured out that it broke for me when Chrome v70 came out. I'm rolling about 26,000 student computers back to Chrome 69 until I figure out what is either broke or changed in Chrome 70.

bbilut · ‎10-10-2018

I do the same... I'm usually a week behind because their updates have burnt me in the past several times. This one seemed urgent so I manually updated this morning. I guess that was a mistake.

bbilut · ‎10-10-2018

I'm rolling back to 8076 and I'll report back what happens. I was getting a detection about every minute or multiple per minute with 8077. Edit: 8076 seems to have stopped the mass amount of alerts.

bbilut · ‎10-10-2018

Same here...I installed 8077 this morning when I get in after reading the email and I'm getting Fallout alerts like crazy. I don't have as many as you, but people just starting coming in.

bbilut · ‎08-03-2018

As far as I'm aware the PA can not decrypt QUIC. I have a Chrome group policy on my environement disabling QUIC in the browser and I block QUIC high up in my rules which would causes Chrome to fail back to SSL.

bbilut · ‎10-17-2017

I have my GlobalProtect setup to offer clients the new download, and in previous versions it always pops up a prompt when you connect and offers the download in the background of the new clients. Well since I've gone to 4.0.4 it pops up the prompt and when you says "Yes" to do the download/upgrade in the background nothing ever happens, and then you get prompted again the next time you connect. Anyone else see this? I think I'm going to roll back to 4.0.3 for now.

bbilut · ‎06-01-2017

Why does the 8.x user agent install have two different installers. Can somebody explain the purpose of the two? In the case of the latest version I see: UaCredInstall64-8.0.2-20.msi UaInstall-8.0.2-20.msi Thanks!

bbilut · ‎04-26-2017

3.1.5

bbilut · ‎04-26-2017

I went to 1703 on my home machine the day it was released and I have not had any problems with the 3.1.5 version.

bbilut · ‎04-26-2017

I upgraded from 7.0.13 to 7.1.7 and I have tons of problems with USERID on the 7.1.x code. I had two tickets open and they opened two bugs for me. One of the problems was the useridd was crashing every several minutes. This was causing me all kinds of problems with userid including portal problems. They claimed my bugs were fixed in 7.1.9, but I'm sticking on the 7.0.x code for now.

bbilut · ‎04-17-2017

We were also a heavy Novell shop and for several years had our Palo Alto userID pointing to both eDir and AD as we transistioned our 40k users away from eDir. I had the same problem with our users that were still on the eDir side, and I never really found a solution. Once you get off eDir you won't have anymore problems.... maybe you can just step up your migration. The captive portal might be a temporary solution for you as well.

bbilut · ‎04-17-2017

Do you have your decryption cert installed in the machines trusted root certificate authorities? The thing I've noticed with Chrome in a recent version update is that if you don't have your decryption cert installed it will not let you bypass the decryption errors to go to a google.com owned site.

bbilut · ‎03-09-2017

If your computers are in a Windows domain you can easily use Group Policy to push your cert out too all your machines and put it in the trusted root. Like some other have mentioned this will take care of Chrome, IE, & Edge, but not Firefox as they have their own cert store and don't use the one built into Windows.

bbilut · ‎03-02-2017

I'm just using Windows server monitor and I don't do any types of client probing as I have 30,000+ machines and it's just not reasonable to probe that many machines. We have a mix of Windows 7, 8.1 and 10 machines and as long as they authenticate to the domain we have no issues reading the user mapping from the domain security logs. When I originally set this up it didn't work because I was not auditing the proper events on my domain controllers and I had problems with the ID dropping and had to set the cache to 1 minute more than my Group Policy refresh time, so I have my cache set to 121 minutes as I notice when the GPO refreshes it trips an event in the security log.

bbilut · ‎03-01-2017

I've been running this same setup for several years, but right now UIA 7.0.7-13 running on Windows 2012 R2 Server against 2012 R2 domain controllers in 2012 R2 fuctional level. 5050's in Active/Standby running 7.0.14 5060's in Active/Standby running 7.0.14

bbilut · ‎03-01-2017

I'm a little confused by your post. I have probably about 6000-8000 Windows 10 Pro machines in my environment now, and we have no issues. We have Windows 2012 R2 as domain controllers and I have UserID Agent running on a Windows 2012 R2 server, and I have no problems detecting who is logged into my Windows 10 machines from the domain security logs.

bbilut · ‎02-28-2017

Same here... currently I have 7.1.8 on my Panorama and my four firewalls have 7.0.14. No issues.

bbilut · ‎02-21-2017

I had a rough 4 weeks trying to run 7.1.7 and I uncovered two bugs that have been reported. I upgraded from 7.0.12 with no issues and then for 4 weeks spent most of my day dealing with high management plane CPU and useridd crashing repeatedly. Last Friday I was have devsvr crashing repeatedly and my internet was down most of the day. I finally gave up and rolled back to 7.0.13 with no issues. My original bug that was started with useridd is supposed to be fixed in 7.1.9. I'm going to stick with 7.0.x branch for the foreseeable future. I have 5060 and 5050 firewalls.

bbilut · ‎02-16-2017

Have you tried it. It's a little different, but I was able to export/import my config from a 5050 into a 5060. Just make sure you're on the same version of OS.

bbilut · ‎02-16-2017

Thanks again for the info. I had a case open, but got better support here. I reset to default and made some minor adjustments. This is what I have now.

bbilut · ‎02-16-2017

That is exacly what I thought that the URL filtering logs were in the URL summary. You would assume, right? Thank you for the reply!

bbilut · ‎02-15-2017

I'm rather confused by the quota settings. I've had my Panorama for about 3 years and was asked to produce a report today and with 500GB of storage I relealized that my history was only about 5 days to produce a user activity report. I would have sworn that wasn't always the case, so I'm not sure what happened. I've been adjusting the quotas, and can't really find a good document to explain the various groups, but I really want to have my quota optimized so I can storage as much user activity as possible. It also seems that either I'm adjust something the wrong way or each time you adjust it wipes out your data because right now I only have 1 hour of history???? These are my current settings I pulled from command line. Can anyone offer any input recommendations. Thanks! system: 1.00%, 4.856 GB Expiration-period: 0 days config: 1.00%, 4.856 GB Expiration-period: 0 days appstat: 1.00%, 4.856 GB Expiration-period: 0 days traffic: 20.00%, 97.130 GB Expiration-period: 0 days threat: 2.00%, 9.713 GB Expiration-period: 0 days trsum: 2.00%, 9.713 GB Expiration-period: 0 days hourlytrsum: 1.00%, 4.856 GB Expiration-period: 0 days dailytrsum: 1.00%, 4.856 GB Expiration-period: 0 days weeklytrsum: 1.00%, 4.856 GB Expiration-period: 0 days urlsum: 55.00%, 267.107 GB Expiration-period: 0 days hourlyurlsum: 1.00%, 4.856 GB Expiration-period: 0 days dailyurlsum: 1.00%, 4.856 GB Expiration-period: 0 days weeklyurlsum: 1.00%, 4.856 GB Expiration-period: 0 days thsum: 2.00%, 9.713 GB Expiration-period: 0 days hourlythsum: 1.00%, 4.856 GB Expiration-period: 0 days dailythsum: 1.00%, 4.856 GB Expiration-period: 0 days weeklythsum: 1.00%, 4.856 GB Expiration-period: 0 days extpcap: 1.00%, 4.856 GB Expiration-period: 0 days hipmatch: 1.00%, 4.856 GB Expiration-period: 0 days

bbilut · ‎02-03-2017

What version were you running in your lab prior to moving to 8.0? It sounds like the same problem I had when I moved from 7.0.x to 7.1.x where in 7.1 they changed the default behavior in app-id and I had to make sure my outbound rules from "application-default" to "any".

bbilut · ‎01-06-2017

I had this same issue after upgrade from 7.0.12 to 7.1.7 and so far support has not been able to figure out why my decryption stopped working. I put in a rule for web-browsing for tcp/443 as suggested in this post and my decryption seems to be working again. Great work on this post guys!

bbilut · ‎09-13-2016

Is any doing any OTP dual factor setups. It would be cool to somehow use Google Authenticator as a second factor.

bbilut · ‎09-08-2016

I'm running 7.0.9 on a 5050 pair and 5060 pair in active/standby with no issues that I'm currently aware of.

bbilut · ‎09-07-2016

FYI: We push our cert out to Windows machines with group policy, iOS devices with our MDM solution (Airwatch), and to our Chromebooks with the Google Mgmt console. That only leaves personal devices (byod), so we put the cert up on our web site with instructions on who to install it.

bbilut · ‎09-07-2016

What you're decryption profile look like? This is how I have mine set (it's pretty loose).

Date Registered	‎07-30-2014 11:05 AM
Date Last Visited	‎09-30-2019 04:21 AM
Total Messages Posted	66
Total Likes Received	20

Online Status	Offline
Date Last Visited	‎09-30-2019 04:21 AM

Strata

Prisma

Cortex

About bbilut