About dannon

dannon

Dang! We are only on 8.13 because of bugs in 9.0 / 9.1 we experienced and had to roll back. Glad it will be there when we finally move to the newer code.

dannon

Joe, I'd like to request that this information also be viewable in the GUI as well, maybe under "monitor"? Always nice to be able to get the info in both places. Maybe add this as a feature-request?

dannon · ‎06-11-2019

Hi @dannon I have added your FR IDs to the list. And in addition I have some comments: @dannon wrote: 1. run a "user activity report" in the "Download URL logs" link which open up a CSV file, please in this file include either the original Username or IP address which was entered into the box on the original "User Activity Report" dialog. We are concerned that Lawyers might not hold the file up in court since it doesn't have a username / IP tied to it. Only the "Download User Activity Report" has that. - FR11763 What abour simply downloading the logs directly from the URL logs? The boss specifically is concerned about detailed user report - he has a specific need to see all traffic for a particular user. He says it allows the ability to see "intent". It's because our HR dept is very wishy-washy and don't want to repremand someone unless there is bullet-proof evidence. I guess the boss is extending this rationale to a legal scenario. I don't always agree with the logic, but it's what he wants to see. @dannon wrote: 3. Show current interface bandwidth in a dashboard widget. Be able to log over time. - FR4507 Since PAN-OS 8.1 there is a device health monitoring in panorama which includes bandwidth We only have 1 firewall, so aren't going to get buy Panorama. Would be nice to add a widget to the existing dashboard natively. I would think it wouldn't be that hard. @dannon wrote: 5. Allow the GUI to change colors - themes. Maybe a dark theme?- FR11765 This is already possible with browser extensions (maybe even directly in the browser) by enabling high contrast modes or by changing the css. I've had other vendors (Fortinet) that allow this natively. It's not a high priority, but since others can do it, why not Palo? I just thought I'd add it to the list for the future in case someone else wants the feature too. @dannon wrote: 6. In "Response Pages", have a "Preview" link, so that we can see the page quickly without having to download and open in another browser. Useful when making changes.- FR913 Because of the low number of this feature request this one is already pretty old so I think the chances that this (checkpoint) feature will be implemented are not that high... Understandable, but again, included just to have a request out there. Tags (0) Add tags

dannon · ‎06-04-2019

Reached out to my SE with these: 1. run a "user activity report" in the "Download URL logs" link which open up a CSV file, please in this file include either the original Username or IP address which was entered into the box on the original "User Activity Report" dialog. We are concerned that Lawyers might not hold the file up in court since it doesn't have a username / IP tied to it. Only the "Download User Activity Report" has that. - FR11763 2. Log and report search keywords - user typed in suicide into Google - FR6186 3. Show current interface bandwidth in a dashboard widget. Be able to log over time. - FR4507 4. Log /report / make a column header the TLS/SSL version detected on HTTPS sites. - FR5678 5. Allow the GUI to change colors - themes. Maybe a dark theme?- FR11765 6. In "Response Pages", have a "Preview" link, so that we can see the page quickly without having to download and open in another browser. Useful when making changes.- FR913 7. Allow for more "User Activity Report" customization - pie charts, different bar charts, color, tables, etc. - FR11764

dannon · ‎05-13-2019

Anyone know how to block these 2 apps? Betternet VPN https://www.betternet.co/ Lemon VPN https://play.google.com/store/apps/details?id=org.lemonvpn.android&hl=en_US We have a BYOD at our K-12 education schools, and students are bringing their own devices in with these installed. I assume there are other VPNs out there coming in too. We have an 'open' BYOD, so no authentication needed, other than agreeing with the AUP. Palo shows no ap-id for either of these and the traffic just pokes right through. We have proxy sites blocked via Palo URL license, and have SSL decryption enabled and make BYOD users install our ssl-forward-proxy cert if they want to use https websites. Any thoughts? Dannon

dannon · ‎04-19-2019

I'd like to add a feature request: run a "user activity report" in the "Download URL logs" link which open up a CSV file, please in this file include either the original Username or IP address whihch was entered into the box on the original "User Activity Report" diaglog. We are concerened that Lawyers might not hold the file up in court since it doesn't have a username / IP tied to it. Only the "Download User Activity Report" has that. Thanks, dannon

dannon · ‎04-16-2018

Here is what I have setup right now. I've see that article before. What I am wondering is what to set things now in order to get things normalized like they were before.

dannon · ‎04-16-2018

Hello. AD integration using the User-ID agent. We were on 8.0.7-2 and things were working fine. I tried upgrading to version 8.1.0-66 and had several problems with wrong user-id being reported. I saw in the release notes for 8.1: • Since multiple username attributes are supported, you must select the Primary Username attribute that you want to use for user identification. • Previously, the firewall normalized usernames received from User-ID sources (such as an LDAP directory) to the domain\username format. In PAN-OS® 8.1, when the Primary Username is in UPN format, it will not be normalized as in previous PAN-OS versions. As a result, usernames My question is if I use the new agent, how can I get my username to show up as domain\userid again? When I tried 8.1.0-66 I was seeing usernames as domain@username and MACHINENAME$ All my rules broke. To correct quickly, I reverted back to the older user-id version. Thanks, Dannon

dannon · ‎04-04-2018

I saw this also. I upgraded to User-Agent 8.1.0 and started seeing strange things. Release notes said Palo changed default naming convention and that it won't display it as domain\username anymore. I was seeing lots of user@domain.name and a lot of machinename$ listings. I didn't know how to fix. I got burned and rolled back to prior version. Issues went away. FWIW Dannon

dannon · ‎01-16-2018

OK. I think that fixed it. I'm confused now about how to enter URLs into the Palo - for adding URLs to a custom category rules, I read here on Palo's site to enter them as *.domain *.domain/ to catch everything. This would be if I wanted to recategorize a URL from a blocked to an allowed custom-URL category. Or vice-versa. I thought adding them to a no-decryption rule would be the same thing.

dannon · ‎01-16-2018

Hello. I've got all of my URLs in a custome URL category called "no decrypt". I've got my decryption rules with the no decryption up top Decryption rule #1 is for bypass. All other traffic gets decrypted by rule #5. Rules 2-4 don't apply in this situation. I also just verified that I have the following in my "no-decryption" URL category: *.clever.com *.clever.com/ I wasn't sure if I needed both URLs in a decryption bypass rule, so I have both.

dannon · ‎01-12-2018

Here are the 2 screenshots. I've got the excel files also, but don't know how to upload them. Good Fail

dannon · ‎01-12-2018

OK. I can do a packet capture on the Palo with and without decryption turned on, so I'd hae 2 sets of captures (drop, firewall, transmit, receive) Which ones would you like me to upload here?

dannon · ‎01-10-2018

Hello. We are using panOS 8.0.7 , Pan-DB URL filtering, and SSL decryption. We are K12 education and use many Chromebooks in the organization. We are trying to use a system called Clever to have our students log into their Chromebooks by scanning a QR code. The problem is I cannot get the program to work. (https://clever.com/) I know the issue is with the SSL decryption because if I exclude the device from decryption, things works correctly and I am prompted to scan my QR code. With decryption turned on, I get a hung screen and can't proceed to the next step of login. I have worked with Palo TAC and Clever support and haven't been able to get it working. I have many URLs excluded from decryption that Google and Clever say need to be bypassed from decyption as well. My next thoughts would be to run some packet captures, but I'm not that familiar with Wireshark analysis. I am thinking I need to look at the headers to see if there are any other URLs which I don't have in my exclude list. Under the traffic logs, for the sessions, I can see some entries are being decrypted. In the URL filtering logs, I can see the sessions are not being decrypted. Anyone have any thoughts on this, or would be willing to help out? Dan

dannon · ‎11-21-2017

Just to add to the conversation- we do SSL decryption and always have hundreds to thousands of these alerts a day. We've always had them, and I just ignore them because they are never an active threat, more informantive in nature. In spite of all of this, I still get a twinge of concern when I see them populate my logs. I want to react to them because I see so many listed. Security-minded brain and all. LOL Dannon

dannon · ‎11-15-2017

Thanks. We run 8.0.5 and I'm glad it's not unique to our setup. I have excluded the website for the time being. Dannon

dannon · ‎11-14-2017

Hello. One of my users was trying to go to: https://mn.b3benchmarking.com/Launch We have SSL forward proxy enabled. If I exclude the site from decryption is comes up fine. We are not using any decryption profiles. Can anyone tell my why the sites won't come up? I did run a check using https://www.ssllabs.com/ssltest/analyze.html?d=mn.b3benchmarking.com but am not sure how to interpret the output. Thanks, Dannon

dannon · ‎11-14-2017

I experienced similar issues. We have a group of users with access to only a few websites. In order for them to display properly, I had to watch each one in the logs and also whitelist all the other linked sites like CDN URLs, etc. It worked, but took time, but I got hit up for it a week later because there was a spot on the webiste I didn't go to that had another URL I needed to whitelist. Terrible pain in the bum for sure. Whish there was a more elegant way. Dannon

dannon · ‎10-06-2017

We looked at this scenario and found that a prodcut like Cisco ISE or similar Network Access Control product would do this. Cost prohibitive for us, so we just have to live with it for now. I would much prefer to know who is coming and going on the wired / wireless networks here.

dannon · ‎09-28-2017

I'm having a hard time getting my URL report built and sorted. I want to accomplish the following 1. category must match ADULT or NUDITY 2. source user must not be a member of FILT_STAFF or M_FILT_STAFF active directory groups (basically students) 3. search all IPs in 10.0.0.0/8 EXCEPT the following subnets 10.10.0.0/21 10.10.8.0/22 10.7.48.0/21 10.7.56.0/21 10.9.0.0/21 10.9.8.0/21 Another way of prhasing it: show me all students who went to PORN or NUDITY sites. Don't show me any IPs which don't have "domain\<student id>" listed as the source user. I don't want to see our BYOD wireless or Chromebook subnets because there is no authentication. Any suggestions? Dannon

dannon · ‎09-22-2017

My case as well. I had an issue open for 2.5 months. I tried escalating the case, but it never did. One of my calls, the tech couldn't even determine the windows server version we were running for our User-ID agent. I had to show him how to get that info. My boss finally had to call our new SE (never told the old one left) and threaten. We got good service then. SE told us that Palo prides themselves on top-tier support, but in the last year have grown so much that they can't get competent people to fill level-1 support. We had a meeting with our SE and the regional manager and they both said Palo is very aware of the problem and are actively taking steps to fix. He said this comes from almost the very top of management. I hope Palo comes through. Dannon

dannon · ‎08-10-2017

I see Palo has changed their detailed user reports now for URL filtering. Prior to 8.x, the PDF/HTML report would show all detail. Now with v 8, the report is split and you get a PDF and a CSV file. The CSV file doesn't have a username attached to it. Management is saying we can't use Palo now becuase detailed reporting won't hold up in court - without a username tied directly to the CSV file, it can't be questioned legally. Anyone have any thoughts? Dannon

dannon · ‎08-10-2017

Long time Palo user. We use the URL filtering add-on. Anyone know if Palo plans on making an extension for Chrome devices? Every other URL filter has this already, and we may have to move off Palo to get this functionality. Thanks. Dannon

dannon · ‎06-05-2017

Ok, I will just sit on it for now. In response to the other poster, yes, our licenses are current and valid for wild-fire and the other 4 palo features we have. Thanks. Dannon

dannon · ‎06-05-2017

After upgrading to PANOS 8.0.2 , I'm seeing the following messages periodically SYSTEM ALERT : high : Request made to PublicCloud server returned with HTTP response code : 456 Not sure what these mean and not sure where these come from. Any thoughts? Dannon

dannon · ‎05-31-2017

Hello. I have recently upgraded our PA-5050 to PanOS 8.0.2. I went to upgrade our UserAgent from v 7.0.7-13 to the new 8.0.2-20 version on our Windows Domain Controllers I was getting errors during the install process and then realized our DCs were NOT 2008R2, only 2008 Service Pack 2. I also noticed we do not run any "read-only domain controllers" in our organization. My question: Is it OK to continue to use 7.0.7-13 UAgent with our firewall running 8.0.2? What do I lose by staying at 7.0.7-13? Thanks, Dannon

dannon · ‎03-28-2017

Hello. We currenly have a Palo-5050 v7.18 doing firewalling and URL filtering. We have SSL decryption enabled. Because Palo does not support transparent authentication using Chromebooks and because we do not like the Palo URL reporting, we are looking at getting rid of the URL filtering part. Do we still need to have SSL decryption enabled for normal firewall apps and function? If yes, does that mean we would need to have multiple SSL certs installed on our client devices: 1 for Palo SSL decyption 1 for new URL filtering product ? Much thanks. Dan

dannon · ‎01-12-2017

Our students range from K - 12 and can end up using a chromebook at some point. We don't have a 1:1 initiative, but they get a lot of use. We have like 3K of Chromebooks here in our District. Yes, having Global Protect wouldn't work. Our teachers have a hard enough time getting students to log in properly with their Google@edu email and password. I've talked with my Palo SE and he said Palo doesn't have anything on the horizon (again). Maybe it's because Palo is a firewall first, and internet content filter second. Pitty though. Other products are adding Google hooks via their API to allow such things. -Dan

dannon · ‎01-10-2017

Yeah, I watched the webinar for that one and tried to set it up, but i couldn't get it working. I tried to contact the authors, but never heard back. Shame, really. Palo should fix this, as many other internet filter vendors have support. Dan

dannon · ‎01-09-2017

We are a school district with 2-3,000 Chromebooks. Currently, we have a Palo rule based upon subnet that applies correct filtering policy. The problem is that we can't see which user is logged in, only the IP address. Does anyone have a solution for this? Does / Is Palo looking at something to correct this? Thanks. Dan

Date Registered	‎08-05-2014 12:21 PM
Date Last Visited	2 weeks ago
Total Messages Posted	51
Total Likes Received	5

Online Status	Offline
Date Last Visited	2 weeks ago

Strata

Prisma

Cortex

About dannon