Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About errevisystem
About errevisystem
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
07-16-2020
20Posts
0Likes
1Solution
Jul 16, 2020Last Visited
User
Activity
User
Profile
Latest posts by errevisystem
| Subject | Views | Posted |
|---|---|---|
| 1743 | 02-24-2016 01:11 PM | |
| 515 | 10-28-2015 03:28 PM | |
| 518 | 10-28-2015 03:24 PM | |
| 532 | 10-28-2015 05:16 AM | |
| 1403 | 07-25-2014 02:16 PM |
User Badges
Public Statistics
| Date Registered | 12-16-2010 10:18 AM |
| Date Last Visited | 07-16-2020 07:28 PM |
| Total Messages Posted | 22 |
10-28-2015
03:28 PM
And yes, of course I have the "Enable Security Log Monitor" option flagged.
PANAgent in the very same W2003 domains and with the very same domain controllers always reads all logon events...
it's about since I've started working with PaloAlto (3 years ago) that I sometimes experience this strange behaviour and really can't understand why I have to rollback to PANagent.
... View more
10-28-2015
03:24 PM
Yes UIA isn't always able to read windows logon events, while the old PANAgent is.
Please note that I have sometimes this issue with very old windows domains.
As for the CP, when and if it's configured as a "complementary" id mechanism with respect to trasparent user-id by the UIA, it bothers users because trasparent id fails. Just to stay on topic, please forget about CP, I have problems with UIA AND with old domains only.
... View more
10-28-2015
05:16 AM
Hi all,
I sometimes have a really hard life mapping domain users with old Windows 2003 forests using UID Agent (no matter if version 6 or 7))
I'll try to explain: when and only when using UID Agent I cannot read all users logon events or, worse, I can't read users at all, ending up having not all domain users transparently mapped and issues with captive portal showing up to not yet mapped users.
It's been a while that I use a simple workaround, that is to say replacing the UID Agent with the old PANAgent...
I know this is absurd, but PANAgent can always read all users, the problem is that the doc states it's no more supported starting from PanOS 6.0 (though it appears to be still working with 7.0 too...). So far I'm convinced that this must not be related to the audit policies on the domain controllers.
According to the docs these are the Windows event logs the UID tries to lookup
Windows 2000 - 2003 SUCCESS_NET_LOGON = 540 AUTH_TICKET_GRANTED = 672 SERVICE_TICKET_GRANTED = 673 TICKET_GRANTED_RENEW = 674 ACCOUNT_USED_FOR_LOGON = 680 Windows 2008 LOGON_SUCCESS_W2008 = 4624 AUTH_TICKET_GRANTED_W2008 = 4768 SERVICE_TICKET_GRANTED = 4769 TICKET_GRANTED_RENEW_W2008 = 4770 ACCOUNT_USED_FOR_LOGON_W2008 = 4776
Anybody having similar issues?
Of course I don't like keep on using PANAgent, but if it can map all users, UID must be able too.
... View more
07-25-2014
02:16 PM
I'm afraid the user source range has not effect, on the other side, narrowing the System port allocation range doesn't help because all connections keep be source from it. I was thinking about opening a case I've never opened one for non-hardware issues, is the procedure the very same? Because here, in Italy, we're not allowed (or at lease we've always been told so) to speak directly with PaloAlto Support, instead we must ask the distributor... Do you think we can write to support@paloaltonetworks.com and make reference to this discussion? It would save a lot of time explaining...
... View more
07-25-2014
01:37 PM
Sure, here's the output netstat -na Active Connections Proto Local Address Foreign Address State TCP 0.0.0.0:135 0.0.0.0:0 LISTENING TCP 0.0.0.0:445 0.0.0.0:0 LISTENING TCP 0.0.0.0:3389 0.0.0.0:0 LISTENING TCP 0.0.0.0:5009 0.0.0.0:0 LISTENING TCP 0.0.0.0:5985 0.0.0.0:0 LISTENING TCP 0.0.0.0:8192 0.0.0.0:0 LISTENING TCP 0.0.0.0:8193 0.0.0.0:0 LISTENING TCP 0.0.0.0:8194 0.0.0.0:0 LISTENING TCP 0.0.0.0:47001 0.0.0.0:0 LISTENING TCP 0.0.0.0:57500 0.0.0.0:0 LISTENING TCP 0.0.0.0:57501 0.0.0.0:0 LISTENING TCP 0.0.0.0:57502 0.0.0.0:0 LISTENING TCP 0.0.0.0:57503 0.0.0.0:0 LISTENING TCP 0.0.0.0:57504 0.0.0.0:0 LISTENING TCP 0.0.0.0:57505 0.0.0.0:0 LISTENING TCP 0.0.0.0:57506 0.0.0.0:0 LISTENING TCP 0.0.0.0:57539 0.0.0.0:0 LISTENING TCP 0.0.0.0:57540 0.0.0.0:0 LISTENING TCP 0.0.0.0:57543 0.0.0.0:0 LISTENING TCP 0.0.0.0:57550 0.0.0.0:0 LISTENING TCP 127.0.0.1:5009 127.0.0.1:23602 ESTABLISHED TCP 127.0.0.1:23602 127.0.0.1:5009 ESTABLISHED TCP 127.0.0.1:57530 127.0.0.1:57532 ESTABLISHED TCP 127.0.0.1:57531 127.0.0.1:57533 ESTABLISHED TCP 127.0.0.1:57532 127.0.0.1:57530 ESTABLISHED TCP 127.0.0.1:57533 127.0.0.1:57531 ESTABLISHED TCP 127.0.0.1:57537 0.0.0.0:0 LISTENING TCP 172.30.2.121:139 0.0.0.0:0 LISTENING TCP 172.30.2.121:3389 192.168.254.142:51599 ESTABLISHED TCP 172.30.2.121:5009 172.30.4.202:41050 ESTABLISHED TCP 172.30.2.121:8194 172.30.2.99:3469 ESTABLISHED TCP 172.30.2.121:8194 172.30.2.121:57538 ESTABLISHED TCP 172.30.2.121:23939 204.79.197.200:443 ESTABLISHED TCP 172.30.2.121:57536 172.30.2.99:8194 ESTABLISHED TCP 172.30.2.121:57538 172.30.2.121:8194 ESTABLISHED TCP 172.30.2.121:57540 172.30.2.121:57541 ESTABLISHED TCP 172.30.2.121:57541 172.30.2.121:57540 ESTABLISHED TCP 172.30.2.121:57558 172.30.2.120:49197 ESTABLISHED TCP 172.30.2.121:57582 172.30.2.8:445 ESTABLISHED TCP 172.30.2.121:59974 172.30.4.134:49231 ESTABLISHED TCP 172.30.2.121:60629 172.30.4.86:135 TIME_WAIT TCP 172.30.2.121:60630 172.30.4.86:49158 TIME_WAIT TCP 172.30.2.121:60634 172.30.4.86:49158 TIME_WAIT TCP 172.30.2.121:60635 172.30.2.120:49197 TIME_WAIT TCP [::]:135 [::]:0 LISTENING TCP [::]:445 [::]:0 LISTENING TCP [::]:3389 [::]:0 LISTENING TCP [::]:5009 [::]:0 LISTENING TCP [::]:5985 [::]:0 LISTENING TCP [::]:47001 [::]:0 LISTENING TCP [::]:57500 [::]:0 LISTENING TCP [::]:57501 [::]:0 LISTENING TCP [::]:57502 [::]:0 LISTENING TCP [::]:57503 [::]:0 LISTENING TCP [::]:57504 [::]:0 LISTENING TCP [::]:57505 [::]:0 LISTENING TCP [::]:57506 [::]:0 LISTENING TCP [::]:57543 [::]:0 LISTENING TCP [::]:57550 [::]:0 LISTENING UDP 0.0.0.0:123 *:* UDP 0.0.0.0:500 *:* UDP 0.0.0.0:3389 *:* UDP 0.0.0.0:4500 *:* UDP 0.0.0.0:5355 *:* UDP 0.0.0.0:51235 *:* UDP 0.0.0.0:57543 *:* UDP 0.0.0.0:57544 *:* UDP 0.0.0.0:58214 *:* UDP 0.0.0.0:60646 *:* UDP 127.0.0.1:20000 *:* UDP 127.0.0.1:23600 *:* UDP 127.0.0.1:57542 *:* UDP 127.0.0.1:59879 *:* UDP 127.0.0.1:59880 *:* UDP 127.0.0.1:61017 *:* UDP 172.30.2.121:137 *:* UDP 172.30.2.121:138 *:* UDP [::]:123 *:* UDP [::]:500 *:* UDP [::]:3389 *:* UDP [::]:4500 *:* UDP [::]:5355 *:* In bold the connection from firewall to agent.
... View more
07-25-2014
10:03 AM
Ok, now I'm logged in on 172.30.2.121 If filtering by ip-only I see traffic show session all filter source 172.30.2.121 -------------------------------------------------------------------------------- ID Application State Type Flag Src[Sport]/Zone/Proto (translated IP[Port]) Vsys Dst[Dport]/Zone (translated IP[Port]) -------------------------------------------------------------------------------- 73733 undecided ACTIVE FLOW NS 172.30.2.121[60449]/lan/6 (193.110.151.6[29772]) vsys1 68.67.179.159[80]/wan1 (68.67.179.159[80]) 222914 web-browsing ACTIVE FLOW NS 172.30.2.121[60464]/lan/6 (193.110.151.6[58695]) vsys1 79.140.82.50[80]/wan1 (79.140.82.50[80]) 89324 twitter-base ACTIVE FLOW NS 172.30.2.121[60462]/lan/6 (193.110.151.6[28556]) vsys1 68.232.35.139[80]/wan1 (68.232.35.139[80]) 218569 undecided ACTIVE FLOW NS 172.30.2.121[60452]/lan/6 (193.110.151.6[8920]) vsys1 69.89.76.20[80]/wan1 (69.89.76.20[80]) 167940 undecided ACTIVE FLOW NS 172.30.2.121[60450]/lan/6 (193.110.151.6[10337]) vsys1 208.71.122.1[80]/wan1 (208.71.122.1[80]) When filtering for user also I have no traffic from the same source IP, even though it's me that generates the requests you can ses above show session all filter source-user *****\**** source 172.30.2.121 Also how can the device see the users mapped correctly if traffic has high source ports not mapped to any users..?
... View more
07-25-2014
09:46 AM
I believe I've not explained, if one of my terminal servers is, i.e., 172.30.2.121 and in the Traffic Log I use the filter " ( addr.src in 172.30.2.121 ) " I can see a lot of traffic sourced from the server, almost all of it is with EMPTY user and source port=System Port Allocation Range, a little bit is with user and source port=User Port Allocation Range Isn't this enough to say that I don't have user information for the server? I've made test rules with source ip only=terminal servers and user=any, and of course they're hit. I can't explain how many rules are in production, some servers are to be filtered accounting for logged in users, some servers not, now it's not of interest, the matter is that I don't have user information on TS servers. After show session info there is no other option admin@itsg-fw2(active)> show session info | Pipe through a command <Enter> Finish input
... View more
07-25-2014
09:20 AM
PANOS is 6.0.2 As for the cli, if mean the show user ip-port-user-mapping all command, yes it shows the same mappings. TS-Agent 172.30.2.121 Vsys 1, Flag 3 Port range: 20000 - 57499 Port size: start 400; max 4000 Block count 94, port count 37500 20000-20399: ********\****** 22800-23199: ********\****** 23600-23999: ********\****** .... Besides I have no match on the correct sec rules where users are indicated If you need some other output let me know.
... View more
07-25-2014
09:10 AM
Hi, yes sorry not to have specified, "lan" zone you can see in the traffic log has already user-identification enabled, all UID Agent mappings are working and all traffic is seen as "user traffic" and not simple ip traffic. The reason why a say "most of traffic coming from terminal servers" is that a tiny little bit of it is seen with user information, but all the rest is with empty user, let's say 99%... Hope it helps
... View more
07-25-2014
08:58 AM
Hi all, this is my environment: PA3020 PANOS 6.0.2 3 Terminal Servers running on Windows Server 2012 R2 Datacencer, each one having PA TS Agent 6.0.3-8 onboard. Documentation states that Windows Server 2012 is supported by TS Agent starting from 6.0.2, it's been a very long time I was waiting for this, till now I've tried previous versions of TS Agent in compatibility mode but the issue was that logged-in user traffic was generated from System Source Port Allocation Range instead Source Port Allocation Range althoug logged-in users were apparently assigned with correct source port ranges. Now that I moved to TS agent 6.0.3 I was hoping to solve but I'm in the very same situation: logged-in user traffic is being generated from System Source Port Allocation Range instead User Source Port Allocation Range Let's have a look to my TS agent configuration It should be as best practice is suggesting. And here you can see the correct user-portrange mappings Unfortunately only a little bit of logged-in user traffic comes out from assigned port ranges, but most of all it comes from system allocated ports I've successfully shrinked the System Port Allocation Range with commands netsh int <ipv4|ipv6> set dynamic <tcp|udp> start=number num=range hoping it'll have reduced the chance the traffic would be sourced from those ports but still no way to obtain the purpose and most of sessions originate from system range... Please note that none of the users are logged in with /admin option. Is there anything missing/wrong? Thank You
... View more
Labels:
- Labels:
-
User-ID
09-27-2013
08:32 AM
Hi all, would a PA200 fit in such scenario? lan users: 70-100 wan connectivity: 10Mbps (so basically 2-zone traffic) Threat prevention: yes (inbound and outbound traffic) URL filtering: yes for all users VPN tunneling: yes (remote access only for few users) Though being the smallest of its breed, according to data sheets this unit is fairly sized for this conditions, my only concern is regarding 1.000/s limit for new sessions. What if we have low traffic, in terms of bandwidth, but spread in many short sessions? Think about p2p and all that sort of things that sometimes you don't neither block nor can't predict in advance. For such reasons, when having to face such scenarios, we often chose to cut short proposing the big brother PA500 to customers, but that's not always feasible. Thank You Manuel
... View more
06-05-2013
09:22 AM
Update: just retried with another platform 5.0.5 and got it working enabling ssl-decrypt url-proxy yes
... View more
06-05-2013
08:53 AM
Hi emr, I had tried before with ssl-decryption (see my previous post) and right now with the method according to your link, I found it very useful and in my opinion that should be the default behaviour, I wonder why it's not. Unfortunately In both cases I cannot get any block page...
... View more
06-03-2013
08:34 AM
I forgot, my PANOS version is 5.0.4. Don't know if this bug could somehow be related: 46649 When denying a web session with a response page, the firewall did not perform a proper close for the TCP connection, causing the client to remain half open. but theoretically it should have been solved starting with 5.0.4...
... View more
06-03-2013
08:28 AM
Hi all, I have a very common security rule permitting all traffic in for 80, 8080 and 443 ports, no matter the application The attached URL security profile denies all url categories except for one (custom). Now I've noticed not to be able to get the expected block page each time a try to access a web site, specifically I can obtain the response page only when the detected application is "web-browsing" but not, i.e, when it's ssl, facebook, gmail etc. So when I go to: gmail.com www.microsoft.com facebook.com etc I get the block page. While when i try with: https://facebook.com https://gmail.com https://kb.bluecoat.com I just get the browser error page but NO block page. This is the TRAFFIC log while this is the URL log as you can see there's no match for anything else than port 80. So I've tried to setup an ssl decryption policy tha shoulfd catch anything for that source ip address, but nothing changes, I keep on getting a block page only when traffic is web-browsing but as you might understand is quite boring for users, whose resulting experience having the page not showing but without knowing the reason.... Is this the expected behaviour? thanks Manuel
... View more
Labels:
- Labels:
-
Troubleshooting
03-13-2013
11:08 AM
Hi, I have a PA500 on PANOS 4.1.9 I'm doing some testing with Exchange, managing to get logs to identify iphones, ipads and android devices without a Captive Portal. Installed USER-ID agent version 5.0.2-2 on a DC, done auto discovery, removed all DCs and left only Exchange Server. It shows up as "connected". After that, i've tried syncing mails via WI-FI on iphone, android and also windows phone but no way of getting some IP to USER mapping. Anyboy was able to get to work? What am i doing wrong? Thanks Sergio
... View more
02-22-2013
02:36 AM
PA-500 PAN-OS 5.0.2 Hello, we've deployed GlobalProtect with local user authentication (authentication profile = local database), user identification is enabled both on trust and vpnclient zones. Also, user mapping is enabled with UID Agent directly from the firewall. Everything's working fine with vpn authentication, once connected the client shows up as the LOCAL user as expected: IP address: 10.1.253.10 (vsys1) <<<<<<<<<<<<< assigned ip address range is 10.1.253.0/24 User: abcde <<<<<<<<<<<<<<<<<< this is in the local user database From: GP Idle Timeout: 2591965s Max. TTL: 2591965s Groups that the user belongs to (used in policy) When the vpn client starts to generate traffic to/from internal lan accessing active directory resources (i.e. remote desktop or network shares) it has to authenticate towards Active Directory with domain credentials. This obviously also generates security logs on the DCs, which are read by onboard UID agents causing ip-user-mapping to change from LOCAL user to AD user for the same ip address: IP address: 10.1.253.10 (vsys1) User: testdomain\testuser <<<<<<<<<<<<<<<<< this is the AD account used to authenticate when accessing internal lan resources From: AD Idle Timeout: 2699s Max. TTL: 2696s Groups that the user belongs to (used in policy) Group(s): cn=vpn_users-all,ou=vpn,dc=testdomain,dc=local This is causing issues since security policies for vpn clients are setup with LOCAL users and not AD users, as obviuos. I'm aware that using AD authentication for GlobalProtect would be advisable, but now we have to keep on with local user authentication. Haw can we prevent AD user-ip-mapping from overwriting the initial (correct) GlobalProtect mapping for vpn client network range 10.1.253.0/24? ps: I've tried the Include/Exclude Network option in Use Mapping section by entering the exclusion for 10.1.253.0/24, but with no success. Thank You
... View more
Labels:
- Labels:
-
User-ID
02-11-2013
08:51 AM
Hi all, i was wondering if it is possible to monitor a subinterface with snmp. I'm trying to monitor bandwidth utilization with Cacti, but i'm only able to check physichal interfaces. Thanks Sergio
... View more
Labels:
- Labels:
-
Configuration
-
Management
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-16-2020
07:28 PM
|
Latest Tags
No tags yet
Latest Blogs
Latest Posts
Copyright 2007 - 2020 - Palo Alto Networks
