About apasupulati

Suhaimi, No, Ldap server is configuration is required to pull user-group mappings, not in this case. If you're sure about the service account privileges(Be sure the user is part of the Distributed COM Users, Server Operators and Event Log Readers groups.), can you ensure the status of the AD shows up as 'Connected' on the firewall? You can run the following command to check the statistics as well- > show user server-monitor state all > show user server-monitor statistics Also, please ensure the firewall is connected to all the DC's the users are logging on to. User-ip-mappings are retrieved by the firewall by reading successful logon events from the security logs on DC. You can run 'set l' on the windows command prompt and that will show the DC user is logging onto. If all this is in place, looking at the userid debug logs should help. > debug user-id on debug > debug user-id set userid servermonitor > debug user-id set userid basic > debug user-id log-ip-user-mapping yes > tail follow yes mp-log useridd.log To turn these off- > debug user-id log-ip-user-mapping no > debug user-id unset all >debug user-id on info This will be a helpful document for you: https://live.paloaltonetworks.com/docs/DOC-5662 Hope that helps, Aditi ... View more

You should be able to configure upto 100 servers to poll, however if you have more than 10 servers, you should use a user-id agent as frequent reading of security logs from all the servers can impact the device CPU. Thanks, Aditi ... View more

Hello, The PAN firewall should allow the reverse telnet traffic to traverse the firewall, but we don't support reverse telnet to be enabled on the firewall. Thanks, Aditi ... View more

Hello, The destination NAT is like static NAT, i.e. One to One translation. It looks like you're trying to do many to many, which is not possible by destination nat. Thanks, Aditi ... View more

Enable the x-forwarded-for option on the PAN device, so the firewall can examine the HTTP headers for the X-Forwarded-for header which a proxy uses to store the original client IP address. You can then verify the URL-filtering logs to see if the real client IP is showing up in the Src field. You may also enable the Strip-x-forwarded-for option: The firewall zeros out the header value before forwarding the request, and the forwarded packets do not contain internal source IP information. Hope that helps! Aditi ... View more