About AbdallaAbdelkhaliq

I have a customer who is trying to configure MFA in GP with RSA SecureID server with Radius server profile (Not the MFA profile that was introduced with 8.1). The first factor should be user name and password and the second factor should be an OTP token. Both username, passowrd and token should be validated by the RSA server. I have done the configuration by following the below KB https://docs.paloaltonetworks.com/globalprotect/8-0/globalprotect-admin/authentication/set-up-two-factor-authentication/enable-two-factor-authentication-using-one-time-passwords-otps.html#   Now when i try to authenticate GP shows only the first step (Password), and it does not prompt for the OTP.   So i need to know if there is a configuration on GP to enable the OTP popup? Also if am using an email/SMS token, the firewall should send a request first in order for the token to be generated, is there is a way to configure this method in PA? also is there is a behavior change between 8.0 and 8.1 in the way GP handles MFA with Radius server profile? ... View more

I have a case in which i found in the traffic logs of the firewall that in a particular day in a span of 4 hours, palo alto have sent traffic to a host that is on a remote site on port 135. Traffic source is PA internal "LAN" interface (used as a service route for LDAP), Destination is the Host on the remote site, Port is 135. Since we have User-ID WMI probing enabled, i have suspected that a user have logged in from this IP and then a user-to-ip mapping entry was generated and then the firewall was trying to query the host directly using WMI, Also the WMI threshold is set to 20 minutes and on the traffic log there is a log every 20 minutes approximatley. Now am trying to investigate why palo alto sent the traffic to this IP at that day, But the problem is: 1) the host is a linux machine. 2) there is no way that this host can reach our internal network because its blocked from the remote firewall, also there are no logs on Palo Alto for this IP trying to connect to AD server or any internal resource. 3) in the # show log userid log, the subject IP is not showing. 4) from AD server events there is no trace for this IP. 5) user-ID is only enabled on the LAN zone, its not enabled for the zone that the subject IP is coming from.   In user ID configuration we have enabled "Enable session read" option, so am suspecting that this host might connected to a shared folder or a printer in the domain which triggered the user-ip mapping.   I would like to know how palo alto is reading the session logs from Active Directory or any windows server, and if there is a way to get these logs to invistigate why palo alto was trying to send traffic to this IP on that day even though its out of its user-ID scope.   ... View more