How to know which GlobalProtect portal profile is being chosen to download the configuration on Logs Viewer

How to know which GlobalProtect portal profile is being chosen to download the configuration on Logs Viewer

2978
Created On 02/06/23 09:07 AM - Last Modified 10/29/24 15:47 PM


Objective


To Identify which GlobalProtect portal profile a specific user is choosing for fetching of the configuration.

Environment


  • Prisma Access Cloud Managed
  • GlobalProtect Portal

Procedure


From Prisma Cloud Managed:
  1. Click on Activity
  2. Click on Log Viewer
  3. Select Firewall/GlobalProtect from the drop down menu
  4. Use the filter: portal = 'GlobalProtect_Portal' AND event_id.value = 'portal-getconfig' AND  AND source_user = 'username' (change username for the real user name)
  5. Portal profile names will be seen under the Description column.
image.png


 
 
 
Other users also viewed:
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000sao0CAA&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language