About DarinSutton

I believe that’s the PCNSA....   try https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/datasheets/education/pcnse-study-guide.pdf   and here is the discussion of the different Certs and the links to guides and documentation https://www.paloaltonetworks.com/services/education/certification#pcnse   also the education Learning component of the paloAlto site has practice exams and other items ... View more

Game Changer - all things we have been concerned with Decryption - more and more everyday IoT - the huge amount of devices that we struggle to see - nevermind control and secure hard to get faster than wildfire - so inline - WOW ---AND it runs on my current devices   Thanx ... View more

you can also get / show / share a 4 hour lab from Fuel -  ... View more

did you ever write a script to either upload or download the updates we are also interested in loading them from a centralized location (local server) - without using panorama ... View more

Any Update? Where you able to get the Chrome user info to work? I know you could use the syslog or NAC info..... Just wondering if you got the info directly from the student ChromBook to work with the User-ID scenario?   Thanx ... View more

did anyone get further with this? Is it possible? how did you handle the user-ID pieces?   Thanx   ... View more

@OtakarKlier - the log forward setting you mentioned are present and correct ....   but they are for traffic ...threat....tunnel...etc   still doesnt show configuration  ... View more

the 'Canned  reports' are on Traffic...Threat...URL....NOT Configuration or system also it is not a choice in the custom reports (Database)   however - you could view the configuration logs and build(save) a filter that would  look for Config changes...ie Set, Edit, Commit -- single or combination of search parameters   after saving it you can re-run it periodically and even export to .csv ... View more

lloks like a known bug on GP 3.1.1 and windows 10 Auto-logon(pre logon) seems like it might have also been addressed might need a reinstall or newer version   see known issues GP 3.1.1   https://www.paloaltonetworks.com/documentation/31/globalprotect/globalprotect-agent-rns/globalprotect-agent-3-1-release-information/known-issues#_79156 ... View more

so if FQDN - do you have DNS working.... also have you confirmed the correct BIND DN and BASE are populating   have you checked LDAp via command line   if bind is incorrect you will see 'improper credentials'   https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Troubleshoot-LDAP-Authentication/ta-p/61818 https://live.paloaltonetworks.com/t5/Management-Articles/Useful-CLI-Commands-to-Troubleshoot-LDAP-Connection/ta-p/57217 ... View more

autologon @ boot or at first logon - by user   machine or user   what are you trying? ... View more

so there are 2 "is it dead methods" DPD - on Phase 1 and  Tunnel Monitor - on phase 2 tunnel monitor does give you more troubleshooting allowances (an IP address is assigned and 'pingable') thus an actual packet traverses the tunnel   are you using static or dynamic routing?   is passive setting enabled....checked? ... View more

Which versions of everything.... FW VM OSPF Panorama   what is output when you run show routing route show routing protocol ospf lsdb show routing protocol ospf dumplsdb   and what is lint type on both boxes - they need to match ....i.e Broadcast   ... View more

wow - many things...I  wish I knew then 1 - Sys logs (not packet cap nor widgets) for VPN troubleshooting 2 - when reading Traffic logs - open detailed view then bottom has firewall policy - missed that first 2-3 months 3 - reports are useful - there are many canned reports that i could schedule... ---side note - cant always make the custom report look like the canned report 4 - add widgets for anything you want to have a quick peak 5 - ACC - build custom tabs to monitor tricky scenarios over many days/weeks 6 - VPN to Cisco not as easy as other vendors - fortunatley there is a document for that 7 - newapps - started when we had 1000 or so - they keep coming and if I'm not on top of them and reading the release notes I can easily/accidentally block something ( default action) that we needed 8 - and a biggie - read the notes when a commit fails/or succeeds and there is a bunch words after.... commit succeeded but....... 9 - one i miss - no POLICY hit count - had in other vendors 10 - not an easy way to see ip to user-ID in the GUI   just a few off the top of my head - still enjoy working with these boxes tho   of 2 more   test policyies and other items  from cli - nice sign up for the security notices from PAn, Fuel, Unit42   ... View more

The difference is ......in Software - instead of Hardware ....done on the larger boxes ... View more

well there is often a short lag it is not real-time but usually not that bad often referred to as Near-time   some of the ACC and reporting can be as much as 15 minutes behind   that being said I have heard some stories of issues with logs taking an hour up to several hours but these were generally associated with reporting from FW to Panorama and/or something to do with an older version of VMWare   glad it actually works now tho ... View more

We had a similar problem   I tried 2 steps - 1 for the URL and 1 for the file   I'm sure there may be a better way,,,but I started with create a custom URL group called Tech Sites added the support team to a group called Tech Folks provided a continue button the the web sites in the Tech Sites group   We still had some issues with those download managers - but this started clearing a few second you might peruse APPLIPEDIA and see what the dependices are and include them also that often provided a bit more info ... View more

There could be a couple explanations   1-does this same report work for another user name 2-are you sure that this user is generating traffic during that time period? ...(sometimes make sure it is a large enough time period first) 3 - spelling counts - this is often my mistake 4 - it may be that however the user is accessing the LAN/WAN/Internet user-ID is not catching them ...(so is it a standard desktop etc that others use for same purpose-and User-ID grabs their traffic)   the document you may want to peruse is User-ID Best Practices https://live.paloaltonetworks.com/t5/Configuration-Articles/User-ID-Best-Practices-PAN-OS   ... View more

Is the rule/application it specifically for Facebook-BASE Does that first rule allow the traffic for another user? in otherwords can another user from the approved 'AD OU' group get to the site   you want to determine is it a user issue or a security policy issue   When you look in the logs afterward - filter by user name and see which policy that traffic is hitting   ... View more