About errevisystem

errevisystem · ‎02-24-2016

VM-100 confirmed to be working too.

errevisystem · ‎10-28-2015

And yes, of course I have the "Enable Security Log Monitor" option flagged. PANAgent in the very same W2003 domains and with the very same domain controllers always reads all logon events... it's about since I've started working with PaloAlto (3 years ago) that I sometimes experience this strange behaviour and really can't understand why I have to rollback to PANagent.

errevisystem · ‎10-28-2015

Yes UIA isn't always able to read windows logon events, while the old PANAgent is. Please note that I have sometimes this issue with very old windows domains. As for the CP, when and if it's configured as a "complementary" id mechanism with respect to trasparent user-id by the UIA, it bothers users because trasparent id fails. Just to stay on topic, please forget about CP, I have problems with UIA AND with old domains only.

errevisystem · ‎10-28-2015

Hi all, I sometimes have a really hard life mapping domain users with old Windows 2003 forests using UID Agent (no matter if version 6 or 7)) I'll try to explain: when and only when using UID Agent I cannot read all users logon events or, worse, I can't read users at all, ending up having not all domain users transparently mapped and issues with captive portal showing up to not yet mapped users. It's been a while that I use a simple workaround, that is to say replacing the UID Agent with the old PANAgent... I know this is absurd, but PANAgent can always read all users, the problem is that the doc states it's no more supported starting from PanOS 6.0 (though it appears to be still working with 7.0 too...). So far I'm convinced that this must not be related to the audit policies on the domain controllers. According to the docs these are the Windows event logs the UID tries to lookup Windows 2000 - 2003 SUCCESS_NET_LOGON = 540 AUTH_TICKET_GRANTED = 672 SERVICE_TICKET_GRANTED = 673 TICKET_GRANTED_RENEW = 674 ACCOUNT_USED_FOR_LOGON = 680 Windows 2008 LOGON_SUCCESS_W2008 = 4624 AUTH_TICKET_GRANTED_W2008 = 4768 SERVICE_TICKET_GRANTED = 4769 TICKET_GRANTED_RENEW_W2008 = 4770 ACCOUNT_USED_FOR_LOGON_W2008 = 4776 Anybody having similar issues? Of course I don't like keep on using PANAgent, but if it can map all users, UID must be able too.

errevisystem · ‎07-25-2014

I'm afraid the user source range has not effect, on the other side, narrowing the System port allocation range doesn't help because all connections keep be source from it. I was thinking about opening a case I've never opened one for non-hardware issues, is the procedure the very same? Because here, in Italy, we're not allowed (or at lease we've always been told so) to speak directly with PaloAlto Support, instead we must ask the distributor... Do you think we can write to support@paloaltonetworks.com and make reference to this discussion? It would save a lot of time explaining...

errevisystem · ‎07-25-2014

Sure, here's the output netstat -na Active Connections Proto Local Address Foreign Address State TCP 0.0.0.0:135 0.0.0.0:0 LISTENING TCP 0.0.0.0:445 0.0.0.0:0 LISTENING TCP 0.0.0.0:3389 0.0.0.0:0 LISTENING TCP 0.0.0.0:5009 0.0.0.0:0 LISTENING TCP 0.0.0.0:5985 0.0.0.0:0 LISTENING TCP 0.0.0.0:8192 0.0.0.0:0 LISTENING TCP 0.0.0.0:8193 0.0.0.0:0 LISTENING TCP 0.0.0.0:8194 0.0.0.0:0 LISTENING TCP 0.0.0.0:47001 0.0.0.0:0 LISTENING TCP 0.0.0.0:57500 0.0.0.0:0 LISTENING TCP 0.0.0.0:57501 0.0.0.0:0 LISTENING TCP 0.0.0.0:57502 0.0.0.0:0 LISTENING TCP 0.0.0.0:57503 0.0.0.0:0 LISTENING TCP 0.0.0.0:57504 0.0.0.0:0 LISTENING TCP 0.0.0.0:57505 0.0.0.0:0 LISTENING TCP 0.0.0.0:57506 0.0.0.0:0 LISTENING TCP 0.0.0.0:57539 0.0.0.0:0 LISTENING TCP 0.0.0.0:57540 0.0.0.0:0 LISTENING TCP 0.0.0.0:57543 0.0.0.0:0 LISTENING TCP 0.0.0.0:57550 0.0.0.0:0 LISTENING TCP 127.0.0.1:5009 127.0.0.1:23602 ESTABLISHED TCP 127.0.0.1:23602 127.0.0.1:5009 ESTABLISHED TCP 127.0.0.1:57530 127.0.0.1:57532 ESTABLISHED TCP 127.0.0.1:57531 127.0.0.1:57533 ESTABLISHED TCP 127.0.0.1:57532 127.0.0.1:57530 ESTABLISHED TCP 127.0.0.1:57533 127.0.0.1:57531 ESTABLISHED TCP 127.0.0.1:57537 0.0.0.0:0 LISTENING TCP 172.30.2.121:139 0.0.0.0:0 LISTENING TCP 172.30.2.121:3389 192.168.254.142:51599 ESTABLISHED TCP 172.30.2.121:5009 172.30.4.202:41050 ESTABLISHED TCP 172.30.2.121:8194 172.30.2.99:3469 ESTABLISHED TCP 172.30.2.121:8194 172.30.2.121:57538 ESTABLISHED TCP 172.30.2.121:23939 204.79.197.200:443 ESTABLISHED TCP 172.30.2.121:57536 172.30.2.99:8194 ESTABLISHED TCP 172.30.2.121:57538 172.30.2.121:8194 ESTABLISHED TCP 172.30.2.121:57540 172.30.2.121:57541 ESTABLISHED TCP 172.30.2.121:57541 172.30.2.121:57540 ESTABLISHED TCP 172.30.2.121:57558 172.30.2.120:49197 ESTABLISHED TCP 172.30.2.121:57582 172.30.2.8:445 ESTABLISHED TCP 172.30.2.121:59974 172.30.4.134:49231 ESTABLISHED TCP 172.30.2.121:60629 172.30.4.86:135 TIME_WAIT TCP 172.30.2.121:60630 172.30.4.86:49158 TIME_WAIT TCP 172.30.2.121:60634 172.30.4.86:49158 TIME_WAIT TCP 172.30.2.121:60635 172.30.2.120:49197 TIME_WAIT TCP [::]:135 [::]:0 LISTENING TCP [::]:445 [::]:0 LISTENING TCP [::]:3389 [::]:0 LISTENING TCP [::]:5009 [::]:0 LISTENING TCP [::]:5985 [::]:0 LISTENING TCP [::]:47001 [::]:0 LISTENING TCP [::]:57500 [::]:0 LISTENING TCP [::]:57501 [::]:0 LISTENING TCP [::]:57502 [::]:0 LISTENING TCP [::]:57503 [::]:0 LISTENING TCP [::]:57504 [::]:0 LISTENING TCP [::]:57505 [::]:0 LISTENING TCP [::]:57506 [::]:0 LISTENING TCP [::]:57543 [::]:0 LISTENING TCP [::]:57550 [::]:0 LISTENING UDP 0.0.0.0:123 *:* UDP 0.0.0.0:500 *:* UDP 0.0.0.0:3389 *:* UDP 0.0.0.0:4500 *:* UDP 0.0.0.0:5355 *:* UDP 0.0.0.0:51235 *:* UDP 0.0.0.0:57543 *:* UDP 0.0.0.0:57544 *:* UDP 0.0.0.0:58214 *:* UDP 0.0.0.0:60646 *:* UDP 127.0.0.1:20000 *:* UDP 127.0.0.1:23600 *:* UDP 127.0.0.1:57542 *:* UDP 127.0.0.1:59879 *:* UDP 127.0.0.1:59880 *:* UDP 127.0.0.1:61017 *:* UDP 172.30.2.121:137 *:* UDP 172.30.2.121:138 *:* UDP [::]:123 *:* UDP [::]:500 *:* UDP [::]:3389 *:* UDP [::]:4500 *:* UDP [::]:5355 *:* In bold the connection from firewall to agent.

errevisystem · ‎07-25-2014

Ok, now I'm logged in on 172.30.2.121 If filtering by ip-only I see traffic show session all filter source 172.30.2.121 -------------------------------------------------------------------------------- ID Application State Type Flag Src[Sport]/Zone/Proto (translated IP[Port]) Vsys Dst[Dport]/Zone (translated IP[Port]) -------------------------------------------------------------------------------- 73733 undecided ACTIVE FLOW NS 172.30.2.121[60449]/lan/6 (193.110.151.6[29772]) vsys1 68.67.179.159[80]/wan1 (68.67.179.159[80]) 222914 web-browsing ACTIVE FLOW NS 172.30.2.121[60464]/lan/6 (193.110.151.6[58695]) vsys1 79.140.82.50[80]/wan1 (79.140.82.50[80]) 89324 twitter-base ACTIVE FLOW NS 172.30.2.121[60462]/lan/6 (193.110.151.6[28556]) vsys1 68.232.35.139[80]/wan1 (68.232.35.139[80]) 218569 undecided ACTIVE FLOW NS 172.30.2.121[60452]/lan/6 (193.110.151.6[8920]) vsys1 69.89.76.20[80]/wan1 (69.89.76.20[80]) 167940 undecided ACTIVE FLOW NS 172.30.2.121[60450]/lan/6 (193.110.151.6[10337]) vsys1 208.71.122.1[80]/wan1 (208.71.122.1[80]) When filtering for user also I have no traffic from the same source IP, even though it's me that generates the requests you can ses above show session all filter source-user *****\**** source 172.30.2.121 Also how can the device see the users mapped correctly if traffic has high source ports not mapped to any users..?

errevisystem · ‎07-25-2014

I believe I've not explained, if one of my terminal servers is, i.e., 172.30.2.121 and in the Traffic Log I use the filter " ( addr.src in 172.30.2.121 ) " I can see a lot of traffic sourced from the server, almost all of it is with EMPTY user and source port=System Port Allocation Range, a little bit is with user and source port=User Port Allocation Range Isn't this enough to say that I don't have user information for the server? I've made test rules with source ip only=terminal servers and user=any, and of course they're hit. I can't explain how many rules are in production, some servers are to be filtered accounting for logged in users, some servers not, now it's not of interest, the matter is that I don't have user information on TS servers. After show session info there is no other option admin@itsg-fw2(active)> show session info | Pipe through a command <Enter> Finish input

errevisystem · ‎07-25-2014

PANOS is 6.0.2 As for the cli, if mean the show user ip-port-user-mapping all command, yes it shows the same mappings. TS-Agent 172.30.2.121 Vsys 1, Flag 3 Port range: 20000 - 57499 Port size: start 400; max 4000 Block count 94, port count 37500 20000-20399: ********\****** 22800-23199: ********\****** 23600-23999: ********\****** .... Besides I have no match on the correct sec rules where users are indicated If you need some other output let me know.

errevisystem · ‎07-25-2014

Hi, yes sorry not to have specified, "lan" zone you can see in the traffic log has already user-identification enabled, all UID Agent mappings are working and all traffic is seen as "user traffic" and not simple ip traffic. The reason why a say "most of traffic coming from terminal servers" is that a tiny little bit of it is seen with user information, but all the rest is with empty user, let's say 99%... Hope it helps

errevisystem · ‎07-25-2014

Hi all, this is my environment: PA3020 PANOS 6.0.2 3 Terminal Servers running on Windows Server 2012 R2 Datacencer, each one having PA TS Agent 6.0.3-8 onboard. Documentation states that Windows Server 2012 is supported by TS Agent starting from 6.0.2, it's been a very long time I was waiting for this, till now I've tried previous versions of TS Agent in compatibility mode but the issue was that logged-in user traffic was generated from System Source Port Allocation Range instead Source Port Allocation Range althoug logged-in users were apparently assigned with correct source port ranges. Now that I moved to TS agent 6.0.3 I was hoping to solve but I'm in the very same situation: logged-in user traffic is being generated from System Source Port Allocation Range instead User Source Port Allocation Range Let's have a look to my TS agent configuration It should be as best practice is suggesting. And here you can see the correct user-portrange mappings Unfortunately only a little bit of logged-in user traffic comes out from assigned port ranges, but most of all it comes from system allocated ports I've successfully shrinked the System Port Allocation Range with commands netsh int <ipv4|ipv6> set dynamic <tcp|udp> start=number num=range hoping it'll have reduced the chance the traffic would be sourced from those ports but still no way to obtain the purpose and most of sessions originate from system range... Please note that none of the users are logged in with /admin option. Is there anything missing/wrong? Thank You

errevisystem · ‎02-25-2014

Does "windows compatibility mode" work?

errevisystem · ‎09-27-2013

Hi all, would a PA200 fit in such scenario? lan users: 70-100 wan connectivity: 10Mbps (so basically 2-zone traffic) Threat prevention: yes (inbound and outbound traffic) URL filtering: yes for all users VPN tunneling: yes (remote access only for few users) Though being the smallest of its breed, according to data sheets this unit is fairly sized for this conditions, my only concern is regarding 1.000/s limit for new sessions. What if we have low traffic, in terms of bandwidth, but spread in many short sessions? Think about p2p and all that sort of things that sometimes you don't neither block nor can't predict in advance. For such reasons, when having to face such scenarios, we often chose to cut short proposing the big brother PA500 to customers, but that's not always feasible. Thank You Manuel

errevisystem · ‎06-05-2013

Update: just retried with another platform 5.0.5 and got it working enabling ssl-decrypt url-proxy yes

errevisystem · ‎06-05-2013

Hi emr, I had tried before with ssl-decryption (see my previous post) and right now with the method according to your link, I found it very useful and in my opinion that should be the default behaviour, I wonder why it's not. Unfortunately In both cases I cannot get any block page...

Date Registered	‎12-16-2010 10:18 AM
Date Last Visited	‎07-16-2020 07:28 PM
Total Messages Posted	22

Online Status	Offline
Date Last Visited	‎07-16-2020 07:28 PM

About errevisystem

Re: VMware ESXi 6.0 and PA VMs

Re: User-ID Agent Windows 2003 logon events

Re: User-ID Agent Windows 2003 logon events

User-ID Agent Windows 2003 logon events

Re: Re: TS Agent 6.0.3 on Windows Server 2012

Re: VMware ESXi 6.0 and PA VMs

Re: User-ID Agent Windows 2003 logon events

Re: User-ID Agent Windows 2003 logon events

User-ID Agent Windows 2003 logon events

Re: Re: TS Agent 6.0.3 on Windows Server 2012

Re: Re: TS Agent 6.0.3 on Windows Server 2012

Re: TS Agent 6.0.3 on Windows Server 2012

Re: TS Agent 6.0.3 on Windows Server 2012

Re: TS Agent 6.0.3 on Windows Server 2012

Re: TS Agent 6.0.3 on Windows Server 2012

TS Agent 6.0.3 on Windows Server 2012

Re: Terminal Services Agents Server 2012

PA200 sizing

Re: missing block-url response page

Re: missing block-url response page

Network Security

Cloud Security

Security Operations

About errevisystem