About jthakur

If you are using Firefox and see message "(Error code: ssl_error_rx_record_too_long) ", then it means firewall has sent the response page however the browser expected the SSL\TLS handshake. You can take a packet capture on client machine to see what's happening. ... View more

I hope below link may help you. How to Serve a URL Response Page Over an HTTPS Session Without SSL Decryption ... View more

Hi Gonzalo, In MIB files, I don't see any OID which can be used to poll  license info. Using XML API you can schedule a job to fetch the issued and expires dates. Regards, Jugnu ... View more

Hi Mel, I used the debug user-id command for syslog strings given as example in below and it it worked fine. How to Configure a Custom Syslog Sender and Test User Mappings > debug user-id test user-id-syslog-parse field-identifier event-string "User Authentication Successful:" username-prefix "username=" username-delimiter "\s" address-prefix "IP=" address-delimiter "\s" log-string "2013-03-20 12:56:53 local4.notice Aruba-Local3 authmgr[1568]: <522008> <NOTI> <Aruba-Local3 10.200.10.10> User Authentication Successful: username=ilija MAC=78:f5:fd:dd:ff:90 IP=10.200.27.67" Field parsing successful, Username 'ilija', Address '10.200.27.67' Which syslog server you are using? Can it convert snmp trap to syslog format? I did some research and found this link and I hope it is helpful in  fixing the problem. Use Syslog Receiver to Integrate with Cisco Wireless Controller Series Please check the above two links and if still no success, then you can open a case with support. Thanks ... View more

Sven_Lieckfeldt, You may need to check PanGPS.log and authd.log to co-relate the authentication events. 1). Check PanGPS.log in global protect client installation path for auth events tried by user. 2).  In PAN cli, execute below command for authentication event generated by user. > less mp-log authd.log Then type /user-name to search any log for the user and keep pressing 'n' until you don't see any relevant log. Or you can search for user authentication event in  authd.log using notepad++ after generating tech support file. Without these logs it is difficult to say what happened. Thanks ... View more

Your regex appears to be correct. But I am not sure how PAN is interpreting #012 and #011. #011 is HT and #012 is LF in ASCII. Below is a command used to test regex for syslog. debug user-id test user-id-syslog-parse regex-identifier event-regex " Enterprise Specific Trap " username-regex " 3.6.1.4.1.14179.2.6.2.39.0 = STRING: "  address-regex " IpAddress: " log-string "syslog string". For "Field Identifier" you can try below example strings. Event String ->  Enterprise Specific Trap Username Prefix ->  3.6.1.4.1.14179.2.6.2.39.0 = STRING: Username Delimiter -> \s Address Prefix -> 3.6.1.4.1.14179.2.6.2.43.0 = IpAddress: Address Delimiter -> \s Try to replace \s with #011 if above delimiter doesn't work. Thanks ... View more

Could you past the syslogs event to get better idea about the strings ? And give a try for "Field Identifier" which is easier than regex. Thanks ... View more

What I understand is you have VPN connection and you want specific users to use mobile devices to access resources. If you are using LDAP based authentication, then create a separate user id and group for mobile users. And create a Global Protect Portal with the user group for mobile users and select Android and iOS under OS. This way only when the both conditions are true, then the VPN will be established. Let me know if don't like this idea. ... View more

In QoS Policy rule ( Polices -> QoS ) we have an Application tab which you can use. If you not are aware of QoS implementation in PA, then first you have to read QoS document QoS in PAN-OS 4.1 ... View more