About Ben-W

Hi MPI-AE,   you can technically run the latest user-id agent as the are backwards compatible: looks at 8.1 agent release notes: The User-ID agent is compatible with PAN-OS® 8.1 and earlier PAN-OS releases that Palo Alto Networks still support.   Agent:  I would Deploy the latest within the given major release so either 8.0.9-6 or 8.1.1-77, while they may not be recommended they will include the latest fixes and protections. otherwise contact tac to obtain the current stable recommended release if any. apologies they used to publish the recommended versions but not sure if they still do as i could not locate for you.   You can either deploy the new agent on a new machince and add the agent to the firewall along side the old agent(s) which would give you the ability to check it is working as expected before removing old agents.. or go straight with upgrading the agent(s)   regards, Ben ... View more

Hi MPI-AE, No worries, so you'll always have release notes for either software or dynamic updates. these can be found by going to support.paloaltonetworks.com (login) and then on the left nav bar check under Updates for software and dynamic updates.   Quick link to software: https://support.paloaltonetworks.com/Updates/SoftwareUpdates/339   Once you've found the relavent software version you will notice the release notes for each version within the release notes coloumn. Alternatively you can access the release notes from the firewalls themselfs. ( Device > Software ). remember to hit check now to obtain the latest list and corresponding links attached.   So in short the User-ID agent "may" work however it will not be supported as stated by the release notes and would suggest plan to upgrade the agent also.   regards, Ben  ... View more

Hi MPE-AE,   Just fyi this information is always included within the release notes found under the software page. Within the release notes: Associated Software and Content Versions   I've had a quick check and can see the minimum supported User-ID™ Agent 8.0.0 is supported for PAN-OS 8.0.x.   kind regards, Ben     ... View more

Hi Sanasheikh,   You can further lock down http/https access based on URL category.  Pretty sure you can use custom URL categories without URL Filtering license if you did not have one.   Hope this helps. regards, Ben ... View more

Hi Yogesba!   While notepad++ works a treat, maniuplating the config in notepad++ isn't always easy, especially if you are not used to the syntax so dont forget you can always use the palo alto networks migration tool 🙂   Couldnt do it justice so check out the link below and follow the link at the bottom of the page for community page/download.   https://www.paloaltonetworks.com/products/secure-the-network/next-generation-firewall/migration-tool   Cheers, Ben   ... View more

Hi Zebust,   Assuming you have checked anything upstream that could be preventing the traffic flow and checked the traffic is being NAT'd correctly leaving your network!.   Might be worth attempting to use service route configuration and use a data port. https://live.paloaltonetworks.com/t5/Configuration-Articles/Setting-a-Service-Route-for-Services-to-Use-a-Dataplane/ta-p/59433   If you have configured L3 data ports, set the service route configuration to use the external Layer3 address to source the service, Traffic should be allowed by default (intrazone allow policy - untrust-to-untrust for example) Normally done for isolated management networks however have had to use this in the past, not sure of the root cause and after updating the firewall, changed back the service route configuration to the mgt port it was successful.   Also doing it this way you can see the traffic in the traffic logs, alternatively if you wanted to go further into troubleshooting the management port: https://live.paloaltonetworks.com/t5/Management-Articles/How-To-Packet-Capture-tcpdump-On-Management-Interface/ta-p/55415   Regards, Ben     ... View more

Hi Chris, I've also just performed Meru user-ID integration.. testing and working on 6.1.5 and 6.1.6.. however does rely on Meru Smart Connect: We limit the amount of information being sent to the PA devices once a user has successfully authenticated using a custom syslog message and then use Field Identifier value to extract the user-id information. Meru uses Smart Connect for the on boarding, provides authentication and handles 802.1x profiles for the devices. From this Smart Connect device we setup syslog forwarding and configured Custom Message Format: We limited the amount of information being sent to the PA devices using the format you can see in the above screenshot. Syslog Parsing Profile implemented on Palo:   Hope that helps Regards, Ben ... View more