About jasbeck

I've opened a ticket but it's been in "reasearch" since 19 March. Hence my open post to here to see what other ideas folks may have. ... View more

Hi Stefan, I thought permissions and network ACLs as well at first, but here's the crux: the user id agent fails the WMI poll, but I can manually run a WMI poll from command line and it polls correctly (using same computer, same account as user id service, etc...). So it's not a permissions nor a networking issue. It's intermittent as well to add to the problem. We have not installed the new agent as we are leveraging Kerberos instead of LDAP for user to group mappings. We have plans to move to the newer agent and use LDAP instead of Kerberos, but not at this time. ... View more

Hi Jason, I think the statement of ".... those new unknown ips will be dropped" is incorrect. I've restarted the user id agent service and the number being reported ramps up from 1001 to (currently) over 5000. I think the ones it can't get to are just re-added to the queue. I typed in the CLI command to see unknown users on the firewall and it came back with zero. Questions: How does this list of unknown user to ips work with the known users to ips that are polled every wmi probe time (60 min for us)? Is it the same queue? Will shortening or lengthing the wmi probing window make it better or worse? I know that unknown user to ip traffic is sent from the PAN to the user id agent for immediate polling to id them. Is this added to the known user to ips that are normally polled at WMI time intervals (documentation indicates as such)? If that is the case, then each user id agent can handle no more than 1000 individual IPs - otherwise it would automatically be over 1000 each poll period. The example cited in the document (User-ID Best Practices PAN-OS 4.1) of 6000 computers being polled at 10 minute intervals would automatically exceed the max queue length since ALL of the 6000 ips would be queued at once to poll every 10 minutes. Or is there some sort of interval within those 10 minutes to split the ips up? Or are unknown users for ips placed in a different queue? Thanks! ... View more

multiple instances of the same user id in different domains? Question: why LDAP and kerberos?  Why not just use kerberos? You using 4.1.x PAN OS and 4.1 pan agent? The fact that LDAP can browse and see the users and groups is independent of Kerberos being able to. If the auth sequences are using kerberos, and all users from stebos domain are failing, then maybe the kerberos server profile for that domain is incorrectly set? ... View more

I had the same issue with 4.1 (4.1.3 in my case). The documentation in the admin guide and user id agent setup fail to tell you this, but if you want to use Kerberos and not LDAP then you have to use the old user id agent 3.1 for AD. Then it will work (provided the account being used to browse has appropriate permissions). The reason being (as explained to me by tech support) is that the PAN does all the user to group mapping in 4.1.x and it only supports that via LDAP at this time. In order to make it work with Kerberos (using Kerberos authentication profiles, sequences, and server profiles) then you have to use the 3.1 user id agent for AD. Even using 4.1.3-2 user id agent in a proxy mode will break it. ... View more

Just an update on this: Finally received a response regading this: It's not possible to see what destination IP (or URL) is causing captive portal to intercept. The GUI logs, nor any CLI log files, include this information. The captive potal log no longer exists in PAN 4.x.x, and the logs containing CP info do not contain the dest IP. The only way we've been able to do it is to turn off captive portal and let all unidentified traffic pass from the CP rules to the security rules where they are blocked (unknown URL traffic is blocked in our environment). At that point we can check the logs. Unfortuantely, this process affects the production environment, so disabling CP for 5 to 10 minutes is the only viable option. ... View more

Yup - that's my understanding of how it works. So - my question once again: is there any way to see what is causing the captive portal connections?  The logs only show succesful flow of traffic, not attempts to port 80 that are stopped or presented an auth page by CP. ... View more

An update on this: upgrading to 4.0.7 did not fix anything. I have been informed by tech support that all PAN devices have a hard cut off of 2500 concurrent connections for captive portal (i.e.: CP is presenting authentication page to users OR, more likely, an automated process using port 80 on workstation is attempting to run and being stopped and "presented" with CP). So, now - my question is:  is there any way to see what is causing the captive portal connections?  What URL or traffic is being seen? The logs only show succesful flow of traffic, not attempts to port 80 that are stopped or presented an auth page by CP. ... View more

The issues we were seeing (captive portal failing to present a page and performing a reset on the connection - checked this via wireshark on an offending machine) were caused by a bug in 4.0.3 where captive portal will start failing after 24 hours. The fix was upgrading to 4.0.7. Seems to be working fine after that. ... View more

out from command is: session_svc_cp                        2447        0 info      session   resource  Sessions allocated for captive-portal Also ran a wireshark session and I see the PAN device actively resetting connections instead of presenting the captive portal page. After a random number of refreshes or hitting enter enough times it will eventually prompt with a captive portal page. See screenshot lines 321 is the initial HTTP GET, 322 is the reset from the PAN. Line 328 is another HTTP GET (same URL) and 329 is the succesful captive portal presentation. ... View more

4.0.3 ... View more

I get the same error when using IE and the famous "connection reset" message when using firefox - however, I think it's related to captive portal intercepting the request for user authentication. I notice it only when the WMI polling fails to correctly identifty the logged on user (if it fails it defaults to captive portal to id) OR if the PC is logged in with an account that would be unidentified and sent to captive portal. Has anyone ever seen this before? Traffic and URL logs do not show anything - I truly mean nothing shown since the request is being intercepted. Is it possible that the PA device is being overloaded so it's not serving the captive portal page? ... View more

Well - here's a doozy. Some additional questions: 1. Enabled WMI/NetBios probing for testing but I still have an IP to user id mapping that I know is incorrect and yet it's still not clearing it out. It's been set to enabled for over 3 hours - so the 20 minute timeout has come and gone several times. Additionally, I've got user-to-ip mappings going to _unknown_ when I know they are good. Is this due to failed netbios probes? I've been assured that any firewall software is disabled and wmi/netbios is enabled on the computers, but the log file on the PAN agent still shows a fail. 2 I thought that when WMI was enabled it would remove all the user to ip correlations it could not verify - and it's removing some it cant verify due to these failed probes I guess, but it's leaving a ton that I know are supposed to have failed because their's nothing using the ip's (failed pings). 3. If WMI polling is disabled, the enable full expire in the XML is set to 1, and age-out timeout is set to larger than 600 minutes (660?) to allow for windows re-auth, what type of event will cause the timeout value to re-start? Is it internet activity or some sort of native windows action? 4. If the items in point 3 (above) work, how will the reauthentication of an "ignored" account cause the incorrect user-to-ip mapping to flush out? ... View more

bump. ... View more

Huh ok. It seems my problem is two fold then. I have machines (personal PCs) that people log in with user id's that are members of AD groups that are in the "filter group" Panagent setup (auto populates from DC IP to userid correlation and applies appropriate filtering permissions). I also have machines (kiosk PCs) that are logged in with user ids that are members of an AD group that is listed as an "ignored" list in Panagent (captive portal prompts for a user id and password). When a filtered user id is used to log in, and then an ignored user is used, it permanently caches the "filtered" user id and does not prompt for captive portal anymore. I've tried manually clearing these entries out via CLI (clear user-cache ...... etc) but it does not clear the user to ip address correlation. What you're saying is that the enable full expire, if set to 1, will clear out the user to ip caching from the pan agent listing if no internet activity is seen from that specific IP. I guess my questions are:      1. How can I make sure that filtered people who are transperantly authenticated via DC security events (PanAgent) on computers that are typically logged in with "ignored" accounts have their cached items removed once they log out of the kiosk PC?      2. How can I make my manual clear commands for specific user to specific ip cache via CLI actually work (they currently dont)?      3. Will the enable full expire set 1 cause any problems with people logged in to their personal PC's? What will they get if they leave a machine logged in but with no internet activity within xx amount of time?      4. If enabling NetBios/WMI polling is the only "sure" fix for this, what sort of network usage load are we talking about? It's a single Panagent device for the complete domain with about 6000 computers. ... View more

So does that affect only Captive Portal authentication or all authenticated people (including "transparent")? The desire is to clear out the authentication from these "generic" kiosk machines only. We have machines that people log into with their personal accounts and do not want those to be prompted for captive portal I want to make sure I understand what the setting does prior to making a change. I found a a document, but it doesnt explain much of anything. (https://live.paloaltonetworks.com/docs/DOC-1233).  What exactly does the "Age-Out Timeout" value affect? ... View more

Hi, The NTLM authentication drop-downs selection boxes in Device \ User Identification \ Captive Portal properties are blank. Whether or not this indicates NTLM is being used, I am not sure - though it would seem to be not being used. Captive portal denials when people fail to put in the domain their user id resides in or incorrect passwords (when they put it in) are showing in the monitor tab as failed captive portal authentication attempts. Session cookies (via the PA device settings) are not enabled. Thanks. ... View more