This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About Ghafar
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About Ghafar
05-16-2018
5Posts
0Likes
0Solutions
May 16, 2018Last Visited
User
Activity
User
Profile
Latest posts by Ghafar
| Subject | Views | Posted |
|---|---|---|
| 2465 | 04-15-2018 11:59 PM | |
| 5125 | 04-15-2018 11:46 PM | |
| 5340 | 04-10-2017 09:11 PM | |
| 3739 | 04-10-2017 01:27 AM | |
| 6035 | 04-10-2017 01:19 AM |
User Badges
Community Statistics
| Member Since | 04-10-2017 01:11 AM |
| Date Last Visited | 05-16-2018 08:10 AM |
| Posts | 5 |
04-15-2018
11:59 PM
Hello ; We have been using PAN OS 7.1.x for months and now due to some requirements I am planning to upgrade our PAN OS to 8.0.x but not sure what the possible problems will be. Therefore, will be good if you share your ideas and comments on 8.0X and what problems you faced during the use so I can consider all these steps before taking any action. We use the following features : What problems you faced on the following features in PAN OS 8.0.X => SSL Decryption => NAT => Application / Port Filtering => User ID Configuration => GlobalProtect I may consider the following features as well in PAN OS 8.0.X => Split Tunneling => SSL VPN (Does it require to purchase a new license to use this feature ? ) => Site 2 Site VPN What version of PAN OS 8.0.X is most stable to be used for large organizations ? Thank You !
... View more
04-15-2018
11:46 PM
After my discussions with palo alto TAC they have mentioned that we can configure the User ID on a single domain with other child domains only so we cannot integrate 2 completely different domains...
... View more
04-10-2017
09:11 PM
Thanks for the idea and the problem here is that the Systems Team is telling the new Domain is child domain of the old domain which has already been integrated with PA FW. Whenever, we check logs for a specific domain it is showing the new domain logs as well but under the old domain which is integrated with Firewall. The Support is telling the user logs in to their own domain but the logs are under another domain... Domains are different and Servers are different, I have found links on Palo Alto website but it indicates the domains as A1.abc.com A2.abc.com A3.com but our scenario is like below with completely different DNSs. abc1.com xyz.com
... View more
04-10-2017
01:27 AM
It seems that you are struggling with blocking Proxy applications like Hotspot Shield but the major point here is that you can only ensure that all Hotspot shield attempts are blocked by enabling the SSL Decryption. As you say the SSL Decryption is not possible on your network then the possibility of the user to bypass the Firewall is high because these Proxy applications like Hotspot shield users IKE, IPSEC, SSH, SSL to create encrypted tunnels which will completely bypass the filtering... You may block Unknown-UDP / TCP and it will block a considerable amount of users but again these apps are trying to bypass the limitation using these ports which will be very difficult to block with a security policy.... Ports: 22, 53, 443, 80, 8080 and many mores or it will open ports.... Monitoring the logs will shows the App is blocked but in the other hand many attempts has already bypassed the firewall...
... View more
04-10-2017
01:19 AM
Hello ; We have configured Captive Portals with LDAP on a Windows Server and it works perfectly fine but now we have planned to add another different domain in LDAP & User-ID configuration but we have some problems which indicates access denied. After running the command less mp-log useridd.log it shows the following response on the end of lines.... Please share if anyone has faced the same or Can we configure the User ID Agent on 2 different domains. Example of different domains (Domain A: Google.com /// Domain B: Amazon.com) while the domain B is the child domain for Domain A and all of the users from Domain B is shown as Domain A. pan_user_id_win_log_query(pan_user_id_win.c:1314): log query for DC3 failed: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied pan_user_id_win_get_error_status(pan_user_id_win.c:1031): WMIC message from server DC3: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied pan_user_id_win_log_query(pan_user_id_win.c:1314): log query for DC3 failed: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied pan_user_id_win_get_error_status(pan_user_id_win.c:1031): WMIC message from server DC3: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied pan_user_id_win_sess_query(pan_user_id_win.c:1463): session query for DC3 failed: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied pan_user_id_win_get_error_status(pan_user_id_win.c:1031): WMIC message from server DC3: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied pan_user_id_win_log_query(pan_user_id_win.c:1314): log query for DC3 failed: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied pan_user_id_win_get_error_status(pan_user_id_win.c:1031): WMIC message from server DC3: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied pan_ssl_conn_open(pan_ssl_utils.c:615): pan_tcp_sock_open() failed; errno=115 pan_user_id_win_log_query(pan_user_id_win.c:1314): log query for DC3 failed: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied pan_user_id_win_get_error_status(pan_user_id_win.c:1031): WMIC message from server DC3: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-16-2018
08:10 AM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks