About eugenep

eugenep · ‎05-06-2018

Hi All, We're collecting user mappings from multiple sources, AD/Exchange, XML-API and Captive Portal and we've just set up User-ID redistribution to share it among various VSYS'. All seems to be going well and user mappings created via AD/Exchange and the XML-API are properly being redistributed except for the user mappings created via the Captive Portal. Does anyone know why that may be the case? The documentation for 8.0 says "You can redistribute user mapping information collected through any method except Terminal Services (TS) agents." so in theory it should be doable. https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/user-id/deploy-user-id-in-a-large-scale-network/redistribute-user-mappings-and-authentication-timestamps Thanks, Eugene

eugenep · ‎12-10-2017

Yep, looks good. Thanks for letting me know.

eugenep · ‎11-22-2017

Thanks again @reaper

eugenep · ‎11-20-2017

Hi @reaper This is still showing up as untrusted. Is anyone planning to fix this up soon? Eugene

eugenep · ‎11-14-2017

If you have a decryption policy in place to block access to untrusted sites, the case management portal https://supportcases.paloaltonetworks.com, is blocked because the certificate chain has not been set up properly. https://www.ssllabs.com/ssltest/analyze.html?d=supportcases.paloaltonetworks.com I have tested this from Sydney, Australia and Los Angeles, USA, both resolve to different IP addresses but both are exhbiting the same issue. Do I raise this a standard support case? Thanks, Eugene

eugenep · ‎08-22-2017

Hi Reaper, Thanks for your reply. I thought that was the case but it didn't seem that way from what could I see. I had also encountered other routing issues at the time, which are still being investigated by TAC, which could have contributed to the issue. - Eugene

eugenep · ‎08-22-2017

My appliance is associating the wrong zone to an ip address. It was picking the correct zone but then stopped. Does any one know why that would be the case and to get it back into the correct zone? I'm running PAN OS 8.0.4. Thanks, Eugene

eugenep · ‎05-22-2017

Thanks @kiwi, I will ask my SE now to do that for me. Regards, Eugene

eugenep · ‎05-22-2017

Hi, I'm setting up two PA5250s in HA and are connecting them up directly to each other. Since these are point-to-point links, i tried using a /31-bit subnet mask, as that is our usual norm for point-to-point links as per RFC3201. Does anyone know why you can't use a /31 for this when they're directly connected to each other? Thanks, Eugene

eugenep · ‎10-12-2015

Hi all, Is it possible to get an interface to respond to the TCP Echo Service on Port 7 via a management profile or some other way? I don't mean a ICMP echo request (Ping) but what's described here https://en.wikipedia.org/wiki/Echo_Protocol https://tools.ietf.org/html/rfc862 I have an appliance that tests network connectivity by using this against its gateway which is an interface on the PAN unit. Thanks, Eugene

eugenep · ‎06-23-2015

Yes, I've read the help documentation. Does that include the fact that there are no sessions available? Is a session in this context, considered a resource?

eugenep · ‎06-23-2015

We'd like to drop any new SSL sessions if the system has reached the SSL Decrypted Session Limit. This page, How to Implement and Test SSL Decryption, says to run: > set deviceconfig setting ssl-decrypt deny-setup-failure yes but it doesn't seem to be there in version 6.1.4 In the Web UI, there is an option under when creating a Decryption Profile, to "Block sessions if resources not available". Is that the same thing? Thanks, Eugene

eugenep · ‎06-02-2015

This issue isn't present on 6.0.9 or 6.1.4. I opened a case with PAN Support while we were on 5.0.14 and had this issue, and all they kept coming back to me was that 5.0.X doesn't support TLS1.2 and sent me to a link of their support cipher pages. I told them it wasn't related to that as I forced Firefox to only use TLS1.1 and disabled the unsupported ciphers and was still getting the same problem. I was getting no where. In the end, we needed to move to 6.x anyway to use some of the new features.

eugenep · ‎07-28-2014

Thanks csharma. That still seems to be a count of the overall bytes in not the active/current rate. When I look at that value it just keeps rising and I doubt I can have an active bitrate of <ibytes>17992771529714</ibytes>. Thanks anyways.

eugenep · ‎07-25-2014

Hi, How can I get the current bitrate of a logical interface at the time its queried via the API or CLI? I've tried 'show interface tunnel.x' but that shows be the overall counters for that interface. I know it can be done as Pan(w)achrome displays that information. When I click on the birate speed in Pan(w)achrome it shows me 'tunnel.x.ibytes.rate', I just don't know where it's getting that from. Will someone be able to help me. Thanks, Eugene

Member Since	‎10-17-2012 06:07 PM
Date Last Visited	‎07-12-2018 04:16 AM
Posts	41
Total Likes Received	3

Online Status	Offline
Date Last Visited	‎07-12-2018 04:16 AM

About eugenep

User-ID redistribution from captive portal user-mappings

Re: Palo Alto Networks Case Management portal has certificate chain issues

Re: Palo Alto Networks Case Management portal has certificate chain issues

Re: Palo Alto Networks Case Management portal has certificate chain issues

Palo Alto Networks Case Management portal has certificate chain issues

Re: IP address associated with wrong zone

IP address associated with wrong zone

Re: HA1 link doesn't support /31-bit subnet mask for point-to-point links?

HA1 link doesn't support /31-bit subnet mask for point-to-point links?

TCP Echo Service on an interface

Palo Alto Networks Case Management portal has certificate chain issues

Re: SSL decryption issues with latest Firefox

Re: Panorama VM is misaligned.

User-ID redistribution from captive portal user-mappings

Re: Palo Alto Networks Case Management portal has certificate chain issues

Re: Palo Alto Networks Case Management portal has certificate chain issues

Re: Palo Alto Networks Case Management portal has certificate chain issues

Palo Alto Networks Case Management portal has certificate chain issues

Re: IP address associated with wrong zone

IP address associated with wrong zone

Re: HA1 link doesn't support /31-bit subnet mask for point-to-point links?

HA1 link doesn't support /31-bit subnet mask for point-to-point links?

TCP Echo Service on an interface

Re: How to drop new SSL sessions when limit is reached in 6.1.X?

How to drop new SSL sessions when limit is reached in 6.1.X?

Re: SSL decryption issues with latest Firefox

Re: Get logical interface active bitrate

Get logical interface active bitrate

Unlock your full community experience!

About eugenep