About jasbeck

I've opened a ticket but it's been in "reasearch" since 19 March. Hence my open post to here to see what other ideas folks may have. ... View more

Hi Stefan, I thought permissions and network ACLs as well at first, but here's the crux: the user id agent fails the WMI poll, but I can manually run a WMI poll from command line and it polls correctly (using same computer, same account as user id service, etc...). So it's not a permissions nor a networking issue. It's intermittent as well to add to the problem. We have not installed the new agent as we are leveraging Kerberos instead of LDAP for user to group mappings. We have plans to move to the newer agent and use LDAP instead of Kerberos, but not at this time. ... View more

Hi Jason, I think the statement of ".... those new unknown ips will be dropped" is incorrect. I've restarted the user id agent service and the number being reported ramps up from 1001 to (currently) over 5000. I think the ones it can't get to are just re-added to the queue. I typed in the CLI command to see unknown users on the firewall and it came back with zero. Questions: How does this list of unknown user to ips work with the known users to ips that are polled every wmi probe time (60 min for us)? Is it the same queue? Will shortening or lengthing the wmi probing window make it better or worse? I know that unknown user to ip traffic is sent from the PAN to the user id agent for immediate polling to id them. Is this added to the known user to ips that are normally polled at WMI time intervals (documentation indicates as such)? If that is the case, then each user id agent can handle no more than 1000 individual IPs - otherwise it would automatically be over 1000 each poll period. The example cited in the document (User-ID Best Practices PAN-OS 4.1) of 6000 computers being polled at 10 minute intervals would automatically exceed the max queue length since ALL of the 6000 ips would be queued at once to poll every 10 minutes. Or is there some sort of interval within those 10 minutes to split the ips up? Or are unknown users for ips placed in a different queue? Thanks! ... View more

multiple instances of the same user id in different domains? Question: why LDAP and kerberos?  Why not just use kerberos? You using 4.1.x PAN OS and 4.1 pan agent? The fact that LDAP can browse and see the users and groups is independent of Kerberos being able to. If the auth sequences are using kerberos, and all users from stebos domain are failing, then maybe the kerberos server profile for that domain is incorrectly set? ... View more

I had the same issue with 4.1 (4.1.3 in my case). The documentation in the admin guide and user id agent setup fail to tell you this, but if you want to use Kerberos and not LDAP then you have to use the old user id agent 3.1 for AD. Then it will work (provided the account being used to browse has appropriate permissions). The reason being (as explained to me by tech support) is that the PAN does all the user to group mapping in 4.1.x and it only supports that via LDAP at this time. In order to make it work with Kerberos (using Kerberos authentication profiles, sequences, and server profiles) then you have to use the 3.1 user id agent for AD. Even using 4.1.3-2 user id agent in a proxy mode will break it. ... View more

Just an update on this: Finally received a response regading this: It's not possible to see what destination IP (or URL) is causing captive portal to intercept. The GUI logs, nor any CLI log files, include this information. The captive potal log no longer exists in PAN 4.x.x, and the logs containing CP info do not contain the dest IP. The only way we've been able to do it is to turn off captive portal and let all unidentified traffic pass from the CP rules to the security rules where they are blocked (unknown URL traffic is blocked in our environment). At that point we can check the logs. Unfortuantely, this process affects the production environment, so disabling CP for 5 to 10 minutes is the only viable option. ... View more

Yup - that's my understanding of how it works. So - my question once again: is there any way to see what is causing the captive portal connections?  The logs only show succesful flow of traffic, not attempts to port 80 that are stopped or presented an auth page by CP. ... View more

An update on this: upgrading to 4.0.7 did not fix anything. I have been informed by tech support that all PAN devices have a hard cut off of 2500 concurrent connections for captive portal (i.e.: CP is presenting authentication page to users OR, more likely, an automated process using port 80 on workstation is attempting to run and being stopped and "presented" with CP). So, now - my question is:  is there any way to see what is causing the captive portal connections?  What URL or traffic is being seen? The logs only show succesful flow of traffic, not attempts to port 80 that are stopped or presented an auth page by CP. ... View more

The issues we were seeing (captive portal failing to present a page and performing a reset on the connection - checked this via wireshark on an offending machine) were caused by a bug in 4.0.3 where captive portal will start failing after 24 hours. The fix was upgrading to 4.0.7. Seems to be working fine after that. ... View more