Most of the time in a small network, we will be using the Layer 3 device as a default gateway and a DHCP server. And most of the time also, we will be excluding the gateway’s ip address from the dhcp pool. Just to save 1 more configuration line and for the sake of knowledge, the IP address configured on the router interface is automatically excluded from the DHCP address pool :). You need to exclude addresses from the pool if the DHCP server should not allocate those IP addresses.

Documentation

Basics of Active Directory
With LDAP syntax the Bind DN, or the user authenticating to the LDAP Directory, is derived by using LDAP syntax and going up the tree starting at the user component.

For example, the user user1 is contained in the Users container, under the example.com domain. The corresponding Bind DN will look like the following:

CN=user1,CN=Users,DC=example,DC=com, but this will be discussed in more detail in the following steps.

In the following example, the domain example.com is used to find the Distinguished Name (Bind DN field for the Symantec Encryption Management Server) for user1. After obtaining the correct Distinguished Name, Softerra can be utilized to find users, attributes, and values. The query is detailed below and can be used with Active Directory 2003 and above.

Type the following command and press Enter

dsquery user dc=example,dc=com -name username-here*

If your user has a long name, the * will do a wildcard match for that user.  For the example below, we’ll use a username of “user1”

Or

dsquery user dc=example,dc=com -name user1

These commands will return the correct Bind DN:
“CN=user1,CN=Users,DC=example,DC=com”

Live example:
dsquery user dc=advanxer,dc=com -name palo*
“CN=Palo Alto User ID,OU=Service Accounts,OU=Users,DC=Advanxer,DC=com”

Configure the following on the Active Directory (AD) Server and the Palo Alto Networks device:

  1. Create the service account in AD, which is utilized on the device. Be sure the user is part of thethe following Groups:
    – Distributed COM Users
    – Event Log Readers
    – Server Operators
    Note: Domain Admin privileges are not required for the User-ID service account to function properly, see Best Practices for Securing User-ID Deploymentsfor more information.

    In Windows 2003, the service account must be given the “Audit and manage security log” user right through a group policy. Making the account a member of the Domain Administrators group provides rights for all operations. The built-in group named “Event Log Readers” is not available in Windows 2003.
    2016-08-10_08-13-20.jpg

  2. The device uses WMI Authentication and the user must modify the CIMV2 security properties on the AD server that connects to the device.
  3. Run ‘wmimgmt.msc’ on the command prompt to open the console and select these properties:2016-07-13_09-50-02.jpg
  4. From the Security tab on WMI Control Properties:
    1.) Select the CIMV2 folder.
    2.) Click Security,
    3.) Click Add and then select the service account from Step 1.
    4.) In this case, it is [email protected].
    5.) For this account, check both Allow for Enable Account and Remote Enable:
    6.) Click Apply,
    7.) Then click OK.
    2016-08-09_userid1.png
  5. Back in the Palo Alto WebGUI, Select Device > User Identification > User Mapping, then click the edit sproket in the upper right corner to complete the Palo Alto Networks User-ID Agent Setup.2016-08-09_userid2.png
  6. Be sure to configure with the domain\username format for username under WMI Authentication tab along with valid credentials for that user.
  7. Enable the Server Monitor options and enable the security log/enable session accordingly.
    Client probing is enabled by default, so disable if desired.
  8. If the domain is configured during Setup in the General Settings/Domain field, the user can elect to discover servers with which to connect. If not, manually add a server to the device:2016-07-13_10-02-16.jpg
  9. Confirm connectivity through the WebGUI or the CLI:
    > show user server-monitor statistics 
    
    Directory Servers:  
    Name                           TYPE     Host            Vsys    Status           
    -----------------------------------------------------------------------------   
    pantacad2003.pantac.lab        AD       pantacad2003.pantac.lab vsys1   Connected

    2016-07-13_10-02-17.jpg

  10. Confirm that ip-user-mapping is working.
    > show user ip-user-mapping all
    
    IP              Vsys  From    User                            IdleTimeout(s) MaxTimeout(s)
    --------------- ------ ------- -------------------------------- -------------- ----------
    192.168.28.15    vsys1  AD      pantac\tom                      2576          2541
    192.168.29.106   vsys1  AD      pantac\userid                   2660          2624
    192.168.29.110   vsys1  AD      pantac\userid                   2675          2638
    Total: 3 users
  11. Ensure Enable User Identification is enabled on the zones where identifiable traffic will be initiated. Select the zone in Network > Zone.
    2016-08-09_userid3.png

Situation:
You have HTTP service running on non-standard port and Palo Alto is blocking it

Steps:
1. Define new application
2. Apply policy

Define new application
1. Go to Object→Applications→Add
2. From the Application window, fill up necessary info as per below example.

Apply policy
1. Go to Policy→Application Override→Add
2. Create new policy and select custom application, set to allow

Situation:
1. You need to do hardware swap (POC unit to actual unit)
2. You don’t have Panorama, and you need to do hardware swap due to RMA

Steps:
1. Ensure components are in the same version
2. Export and Import config
3. Commit configuration

Ensure components are in the same version
1. Make sure all components (PAN-OS, PAN-DB, Threat Prevention, Wildfire, GlobalProtect) are in the same version, license too.
1. To do PAN-OS software update, navigate to Device→Software
2. To do components update, navigate to Device→Dynamic Updates
3. To do PAN-DB update, navigate to Device→Licenses→PAN-DB Url Filtering

Export and Import config
1. From the old unit, navigate to Device→Setup→Operations

2. Click “Save named configuration snapshot” and give it a name. Example: ABC123.xml

3. Click “Export named configuration snapshot” and select ABC123.xml.

4. From the new unit, navigate to Device→Setup→Operations
5. Click “Import named configuration snapshot” and select ABC123.xml (config file from old unit)
6. Once imported, click “Load named configuration snapshot” and select ABC123.xml

Commit configuration
1. When you click commit, the firewall will start applying the configuration, meaning there’s a possibility that the ip will be duplicated in the network.
2. Normally I only connect Management port in the new unit, and leave other interfaces unplugged.
3. Click commit, and immediately unplug Management interface in the old unit. You will no longer have access to the old unit. New unit will be taking over the Management ip.

This post shows how to configure a TACACS+ server for system authentication in Juniper SRX with open source tac_plus software.

Brocade IronStack configuration
aaa authentication web-server default local
aaa authentication login default tacacs+ enable local
aaa authentication login privilege-mode
aaa accounting commands 0 default start-stop tacacs+
aaa accounting exec default start-stop tacacs+
aaa accounting system default start-stop tacacs+
tacacs-server host 10.14.14.55
tacacs-server host 10.18.15.145
tacacs-server key NASKEYHERE
tacacs-server timeout 10
ip tacacs source-interface ve 998

reference: http://www1.brocade.com/downloads/documents/html_product_manuals/FI_ICX6650_07500_SCG/wwhelp/wwhimpl/common/html/wwhelp.htm#context=Security-converted&file=FI_Security.03.6.html

This post shows how to configure a TACACS+ server for system authentication in Juniper Netscreen SSG with open source tac_plus software.

Juniper Netscreen SSG Configuration
set auth-server TACACS id 1
set auth-server TACACS server-name 192.168.1.100
set auth-server TACACS backup1 192.168.1.200 (optional)
set auth-server TACACS account-type admin
set auth-server TACACS type tacacs
set auth-server TACACS tacacs secret Tacacssecret1
set auth-server TACACS tacacs port 49
set admin auth server TACACS
set admin auth remote primary
set admin auth remote root
set admin privilege get-external

tac_plus configuration
key = Tacacssecret1
group = netscreen
{
service = netscreen
{
vsys = root
privilege = root
}
}
user = nmsns {
default service = permit
login = file /etc/passwd
member = netscreen
}

This post shows how to configure a TACACS+ server for system authentication in Juniper SRX with open source tac_plus software.

Juniper SRX configuration
Connect to SRX and enter configure mode
[email protected]% cli
{primary:node1}
[email protected]> configure
warning: Clustering enabled; using private edit
warning: uncommitted changes will be discarded on exit
Entering configuration mode{primary:node1}[edit]
[email protected]#

Add a new TACACS+ server and set its IP address.
[email protected]#set tacplus-server address 172.16.98.24

Specify the shared secret (password) of the TACACS+ server.
[email protected]#set tacplus-server 172.16.98.24 secret Tacacssecret1

Specify the device’s loopback address as the source address.
[email protected]#set tacplus-server 172.16.98.24 source-address 10.0.0.1

Set for single connection authentication
[email protected]#set tacplus-server 172.16.98.24 single-connection

Set authentication order
[email protected]# set system authentication-order tacplus
[email protected]# set system authentication-order password

Set accounting logging
[email protected]# set system accounting events login
[email protected]#set system accounting events change-log
[email protected]#set system accounting events interactive-commands
[email protected]#set system accounting destination tacplus

Verify configuration
[email protected]# show system tacplus-server
[email protected]# show system accounting

tac_plus configuration
key = Tacacssecret1
group = srx {
service = junos-exec
{
local-user-name = root
}
}

user = srxadmin {
default service = permit
login = file /etc/passwd
member = srx
}

Incoming search terms:

  • how to add tacacs to junos
  • tacacs accounting

Scenario:

Using Microsoft Windows built in VPN Client to connect to remote PPTP VPN server through Cisco ASA firewall.

Symptom:

Error 619

Solution:

In ASA Firewall, enter below command.
ASA-active#conf t
ASA-active(config)#policy-map global_policy
ASA-active(config-pmap)# class inspection_default
ASA-active(config-pmap-c)#inspect pptp
ASA-active(config-pmap-c)#exit
ASA-active(config)#access-list $Inbound_Interface_ACL permit gre $source_ip/network any
ASA-active(config)#access-list $Inbound_Interface_ACL permit permit tcp $source_ip/network any eq pptp

Common Troubleshooting in Windows VPN Client

1. Open VPN Properties window, go to Security tab.
2. Change “Type of VPN” to PPTP

Incoming search terms:

  • pptp through cisco vpn

object-group network og-rfc1918
10.0.0.0 /8
172.16.0.0 /12
192.168.0.0 /16
!
ip access-list extended acl-nat
permit ip object-group og-rfc1918 any
!
route-map rm-site-a
match ip address acl-nat
match interface FastEthernet0/0
!
route-map rm-site-b
match ip address acl-nat
match interface FastEthernet1/0
!
ip nat inside source route-map rm-site-a interface FastEthernet0/0 overload
ip nat inside source route-map rm-site-b interface FastEthernet1/0 overload

This keeps things a bit simpler because the router can rely on the routing table to figure out which NAT table to use based on the destination rather than hard-coding the destination into the ACLs.