About robg303

Thanks for the confirmation, I was wondering what I was missing after upgrading to 6.01 thinking that was the fix ... View more

I've upgraded to PANOS 6.01, set the Service Route Configuration for Syslog as Source Interface=Any, and Source Address to be my internal class-c Network. Upon removing the Destination tab information where the destination is my syslog Server IP, source Interface=Any, and Source Interface being the default Gateway IP I'm still only seeing configuration logs items, so it's basically the same issue moving to 6.0.1. If I modify the Destination tab back to what it was previously, i then begin to see Traffic logs again being sent to my firewall analyzer/syslog. If version 6.0.1 correct the issues where I don't have to many put in the destination for my syslog, is there something i'm missing here? ... View more

Thanks for the input on the destination tab, I'm now receiving syslogs! Hopefully this will get addressed soon. ... View more

I've opened a case with Palo Alto and have sent tech support files, but as a only have standard support I'm sure it'll take some time to address. I'm glad (in an odd way) that i'm not the only one seeing this problem as I've reconfigured syslog settings on the PAN, syslog server, ports, and firewall configs all with the same results. ... View more

Yeah... sure is. That's what i can't figure out, seems odd and is driving me crazy... I haven't changed anything from the previous version, but also noticed I can only ping my internal DNS and default gateway server when I SSH'd to the management console all of which are on the same class-c subnet, as are my other servers and workstations.My syslog forwarding profile is to my internal log analyzer on standard port udp 514 and my service route is configured for 'source interface any' and source address as 192.168.0.1/24 ... View more

Hulk.. thanks for your input! I've performed the above commands and see NO syslogs sent. Issuing the debug command the traffic log count is incrementing, but showing the logging status, its reporting the below. I can't figure out what configuration change i need to make to send the logs correctly as it worked fine in 5.x can you assist? (for what it's worth, i have my syslog in the PAN configured for UDP) xxxxx@pa-200> show counter management-server Log action not taken            :          0 Logs dropped because not logging:          0 User information from AD read   :          2 Certificates information read   :          0 License information fetched from update server:          0 Log action syslogs sent         :          0 Sighash refcount                :          6 Tunnelhash refcount             :          7 URLcat refcount                 :          7 ip2loc refcount                 :          2 External Forwarding stats:       Type  Enqueue Count     Send Count     Drop Count    Queue Depth     Send Rate(last 1min)     syslog         267428         267428              0              0               0      xxxxxx@pa-200> debug log-receiver statistics Logging statistics ------------------------------ ----------- Log incoming rate:             0/sec Log written rate:              0/sec Corrupted packets:             0 Corrupted URL packets:         0 Logs discarded (queue full):   0 Traffic logs written:          267406 URL logs written:              3 Wildfire logs written:         0 Anti-virus logs written:       0 Spyware logs written:          0 Attack logs written:           0 Vulnerability logs written:    0 Fileext logs written:          27 URL cache age out count:       0 URL cache full count:          0 URL cache key exist count:     0 Traffic alarms dropped due to sysd write failures: 0 Traffic alarms dropped due to global rate limiting: 0 Traffic alarms dropped due to each source rate limiting: 0 Traffic alarms generated count:  0 Log Forward count:             0 Log Forward discarded (queue full) count: 0 Log Forward discarded (send error) count: 0 Summary Statistics: Num current drop entries in trsum:0 Num cumulative drop entries in trsum:0 Num current drop entries in thsum:0 Num cumulative drop entries in thsum:0 External Forwarding stats:       Type  Enqueue Count     Send Count     Drop Count    Queue Depth     Send Rate(last 1min)     syslog         267436         267436              0              0               0       snmp              0              0              0              0               0      email              0              0              0              0               0        raw              0              0              0              0               0 xxxxxx@pa-200> debug log-receiver statistics Logging statistics ------------------------------ ----------- Log incoming rate:             1/sec Log written rate:              1/sec Corrupted packets:             0 Corrupted URL packets:         0 Logs discarded (queue full):   0 Traffic logs written:          267410 URL logs written:              3 Wildfire logs written:         0 Anti-virus logs written:       0 Spyware logs written:          0 Attack logs written:           0 Vulnerability logs written:    0 Fileext logs written:          27 URL cache age out count:       0 URL cache full count:          0 URL cache key exist count:     0 Traffic alarms dropped due to sysd write failures: 0 Traffic alarms dropped due to global rate limiting: 0 Traffic alarms dropped due to each source rate limiting: 0 Traffic alarms generated count:  0 Log Forward count:             0 Log Forward discarded (queue full) count: 0 Log Forward discarded (send error) count: 0 Summary Statistics: Num current drop entries in trsum:0 Num cumulative drop entries in trsum:0 Num current drop entries in thsum:0 Num cumulative drop entries in thsum:0 show logging-status -------------------------------------------------------------------------------- ---------------------------------------------       Type      Last Log Created        Last Log Fwded       Last Seq Num Fwded Last Seq Num Acked         Total Logs Fwded -------------------------------------------------------------------------------- --------------------------------------------- > CMS 0         Not Sending to CMS 0 > CMS 1         Not Sending to CMS 1 >Log Collector         Not Sending to Log Collector ... View more

Coming from BlueCoat and relatively new to PAN, I found out you have to manually type the domain\userid to apply to an individual. This will be my solution for now and just create policies around groups and not individuals which is probably best and more easily managed. Thank you all for your input and support! ... View more

When i build firewall policy rules, say for 'URL Filtering', I should be able to not see all the groups pulled from AD, but also the userid's i want to add to that policy. Only group names are listed and not actual user names: Below is a screen shot of when i expand the 'Group Include List' in Group Mapping, i should be able to see the users I've created in AD under CN=Users ,CN=Domain Users, or whatever group they're a part of I created a user called 'test' in AD, and issuing the below command, it's not found in any group admin@PA-200> show user user-IDs match-user <test> User Name                       Vsys    Groups ------------------------------------------------------------------ Total: 6 Using another AD Browser and searching for the user 'test' it can be found, but it's not listed or shown in the PAN when expanding group-mapping ... View more

Show user group list works fine, i can see the list of groups, but attempting to query the 'users' group I get the following: <response status="success"><result>User group '<users>' does not exist or does not have members</result></response> admin@PA-200> show user group name <guests> I have following the link provided and everything matches up, anything else you can think of to force a sync or some other configuration item? Thanks for all the help on this! ... View more

Creating a Security Rule and in Policies\Security under 'user', selecting 'any', 'pre-logon', 'known user', or 'unknown' it populates the same list (ie.. <domain>\<group name>). Manually typing in <domain>\guest it finds it.  Using the same format and putting in the name of a user I created in AD in place of 'guest' it's not being found, basically it's only listing the groups names and not pulling created user names which i can see logged into into my domain controller. ... View more

I upgraded my Pa-200 from 5.0.4 to 5.0.10 and have the current version of the user-id running on my DC. The upgrade went fine, rebooted, and still do not see user names populated under 'cn=users' in the 'Group Map Settings' expanding 'Group include list' Any others ideas? ... View more