Hi All,   Thank you so much for your valuable suggestions and inputs. As I was getting too much pressure from the users that file sharing is not working. I search for a workaround and found below article referring to Application override.   http://www.mybenke.org/?p=2542   The workaround work for me amazingly, users are now able to access file shares but log off issue is still exist. I think above workaround cannot be consider as a permanent solution. Hence I am planning to upgrade the OS to 8.1.10 as suggested above. I will share the outcome with you guys after up-gradation. ... View more

Hi Steve,   Thanks for your response, let me elaborate in more detail.   FW current version is PANOS 8.1.0   1. I have already verified on trust zones "User ID Identification" is enabled. In troubleshooting i took new security policy and in Source User field I searched multiple AD users and it gave mr correct results, even a newly created user was also listed. It means FW is fetching users data from Active Directory properly but information is not included in traffic logs.   2. "resource-unavailable" is only showing on Users to Shared Server and AD transactions. log filter: ( session_end_reason eq resources-unavailable ) as you can see the only those transactions having APPID ms-ds-smbv1, ms-ds-smbv2 & ms-ds-smbv3 are ended with "resource-unavailable"   3. When a domain computer logged off it communicate with AD for graceful session end and AD writes are logoff log in events. it can be see in above logs "resource-unavailable" are also showing on AD transactions logs, that is why I am troubleshooting the issue from FW end.   I have 7 remote sites and almost all users are facing same issue then how it could be relate to local PC. In my opinion this OS version is internally blocking above APPIDs and it could be a bug. ... View more

I am using below SFP modules with PA-820, These are Gigabit Ethernet interface and working fine for me.   > show system state filter sys.s1.p5.phy sys.s1.p5.phy: { 'link-partner': { }, 'media': SFP-CAT5, 'sfp': { 'connector': Unknown, 'encoding': 8B10B, 'identifier': SFP, 'transceiver': 1000B-T, 'vendor-name': FiberStore , 'vendor-part-number': SFP-GB-GE-T , 'vendor-part-rev': B , }, 'type': Ethernet, }               ... View more

Nothing happens on clicking "View Certificate". ... View more

Hi Luke,   Appologize for delayed response, i have attached some screenshots in above message mentioning the SSL error in Chrome & Firefox, i have also attached traffic logs for ISP1 (Succesfull Decryption) and ISP2 (Unsuccesfull Decryption).    Note: Non SSL sites are working fine on ISP2. ... View more

Hi Luke,   Thank for responding on the query, below are answers of your questions.   Q1 - Where did you obtain the certificate from? Was it from Active Directory Certificate Server (or PKI equivalent) or self-signed on the firewall? Ans: Certificate is self singed generated from Palo Alto   Q2 If from PKI, is the machine part of the domain, and have you pushed out this cert to "Trusted Root Certification Authorities" folder via GPO? Ans: I have manually imported the certificate on testing machines in Trusted Root of all browsers   If self-signed, the certificate needs to be installed again in the Trusted Root Certification Authorities folder for the local machine.   Q3 - If the certificate marked as CA? Certificate authority? Ans: Yes, the certificate is marked as CA.   When i put testing machin on ISP 1 there no certificate error, decryption is succesfull and i got proper application detection but when i put the same machine on ISP 2 it gives SSL error.   Some Important points: I have one SSL certificate on the firewall and two decryption policies for ISP1 and ISP2 users. ISP1 is configured with default route while traffic is forwarding to ISP via PBF Both ISPs are in different untrust zones Source Zone is same If i disable SSL decryption policy for ISP2 then browsing was succesfull   Any guess?? ... View more