About markuskohlmeier

Hi. I already tried that, but I got the response bad username or password only one or two seconds after I entered my credentials. In the authentication log I can see that both authentications work well.   Best regards, Markus ... View more

Hi. Custom App could be difficult if SSL is used (looks like that they use SSL regarding of the required ports). They dont use a lot URLs. I would setup a custom URL category and use it as a match criteria within my security rulebase with Application any and the requested ports. After a while traffic is traversed that rule I would setup a report to get information about the used applications and at them to that rule.   Cheers, Markus  ... View more

Hi. At first I would take care that the Panorama is able to connect to your firewall. Did you commit the configuration to Panorama after you add the SN from your PA as a managed device? Did you commit your configuration on the firewall after you add the Panorama IP? Is your firewall able to resolve the FQDN of the Panorama if you use FWDN instead of IP address for Panorama configuration If you have configured permited IP addresses for management on the firewall, add the Panorama IP to that list Is the Panorama MGMT within the same network as the firewall MGMT? If not, is there for examlpe a firewall in between that has to allow the traffic?   Hope thats help.   Best regards, Markus ... View more

Hi. I tried that allready, without success. ... View more

Hi. Just to be clear, I setup user-id, also in large envoirments, several times successful. But this time I have problems with the group mapping respectively the domain-map. So it would be interesting if anyone know which AD attribute or value Palo Alto Network use as domain-map.   Thank you and best regards, Markus ... View more

Yes, of course. ... View more

Hi pakumar.   I know all these documents and I configured it as usual (and as described in the documents). But without success. I think my problem is the domain-map, because it should not be empty.   Best regards, Markus ... View more

Hi community. Does anyone know if it is possible to overwrite the ip-user-mapping collected by the user agent via the xml-api? It looks like that it is not possible to logout the user via the xml-api when the information is collected by the user agent. When I send a login via the xml-api before the logout it seem to be ok. Regards, Markus ... View more

Hi, this is not the problem. It looks like the problem is that the information is collected via the user agent itself and not the via xml api. ... View more

Hi NGS, I was able to test your srcipt (good job by the way). But also with your script I did not work. I get the same error in the user agent log. [Debug  374]: XML API IP x.x.x.x(name domainY\userZ) logoff but entry not existed. Regards, Markus ... View more

Hi NGS, thank you very much. I will try it. Regards, Markus ... View more

Hi NGS, I tried it with switched order of the name and ip already, but without any success. The user agent has the version 5.0.4-5 and the firewall is running on PAN-OS 5.0.3. Regards, Markus ... View more