Solving Palo Alto User-IP Mapping issue while connecting via Pulse Secure VPN

     In Palo Alto firewalls you can create username based rules. But TCP connections do not rely on usernames, they are based on source ip address, destination ip address, source port, destination port etc. So there should be mapping that will tell firewall which ip is mapped to the username. Palo Alto has various methods to collect and populate user-ip mappings table.
   
     In a Windows environment firewall admins used to integrate User-ID agent with Active Directory to listen logon events. So when a user logins to his/her PC in a domain, user-ip mapping is created from the logon event that is generated on the DC.

    After this brief introduction about user-ip mapping lets come to the issue, If  two users get same ip in a sequence.

   When users get connected to the corporate network via Pulse Secure VPN they are assigned an ip from the pool of a DHCP server. After this assignment, Palo Alto user id agent creates the user-ip mapping. When that specific user disconnected from the VPN, Pulse Secure sends DHCP release and the IP address sent back to the available ip pool. But the user-ip mapping is not cleared on the user-id agent side. So when another user gets connected and gets the same ip, all rules will be also valid for this user. But this is a really serious security issue.

   To solve this issue you can configure user-id agent as a syslog server and configure Pulse Secure VPN to forward auth events to this server. ,

   First you should define login-event regex to create user-ip mapping and logout regex  to clear user-ip mapping.

     Then you should add Pulse Secure VPN ip as a syslog sender and add above event filters to the profile.

    After these settings user-ip mappings will updated as expected. And no wrong user-ip mapping will occur.

Creating proxy pac files automatically from Squid Conf file.

Pac files are automatic proxy configuration files written in js format that browsers can interpret and route clients to the proxy according to the domain name they visit. This pac file should be published through a web server or can be manually downloaded and the browser should be configured to the downloaded pac file. Squid is an open source proxy server which can be configured to be used by libraries for out off campus access to the academic database subscriptions . When someone add/delete/update an entry in the squid conf file, pac files should also be updated properly. This is a tedious task for large numbers of urls. Python script which automates this task with per minute cron entry

The script pushes syslogs to the syslog of the system on every execution. If any changes made to the squid file, the pac file is updated by checking the hash of the old and new states of the file. Also the squid proceess is restarted if any change has been made.

import hashlib
import os
import syslog
import datetime
import shutil
import subprocess
squid_config_file_path="/etc/squid/kutuphane_veritabanlari.squid"
squid_config_file = open(squid_config_file_path)
readFile = squid_config_file.read()
pac_file_root="/var/www/html"
hash_file="%s/hash_file"%pac_file_root
old_pac_file="%s/proxy.pac"%pac_file_root
date_=datetime.datetime.now() 
backup_file="%s/pac_backup_file_%s.pac"%(pac_file_root,date_)
new_pac_filee="%s/new_pac_file.pac"%pac_file_root
sha1Hash = hashlib.sha1(readFile)
sha1Hashed = sha1Hash.hexdigest()
if os.path.exists(hash_file):
   hash_filee = open(hash_file,'r')
   readHash = hash_filee.readline()
   hash_filee.close()
   if not readHash==sha1Hashed:
 syslog.syslog(syslog.LOG_WARNING,"Hashes are different  kutuphane_veritabanlari.squid config file has been modified the old hash :%s new hash:%s "%(readHash,sha1Hashed))
 shutil.copyfile(old_pac_file,backup_file) 
 new_pac_file = open(new_pac_filee,"w+")
    new_pac_file.write("function FindProxyForURL(url, host) {\n")
 new_pac_file.write("var proxyserver = 'proxy2.iyte.edu.tr:8080';\n")    
 new_pac_file.write("var proxylist = new Array(\n")
    with open(squid_config_file_path) as openfileobject:
           for line in openfileobject:
          if (line[0].isalpha() or line.startswith(".")):
   new_pac_file.write('"%s",\n' % (line.rstrip()))
        new_pac_file.write('"dummy.com"\n);\n')
    new_pac_file.write("for(var i=0; i<proxylist.length; i++) {\n")
    new_pac_file.write("\tvar value = proxylist[i];\n")
    new_pac_file.write("\t\tif (dnsDomainIs(host, value) ) {\n")
    new_pac_file.write("\t\treturn 'PROXY '+proxyserver;\n")
    new_pac_file.write("\t}\n")
    new_pac_file.write("}\n")
    new_pac_file.write("return 'DIRECT';\n")
    new_pac_file.write("}")
 new_pac_file.close()
 os.remove(hash_file) 
 hash_file_create=open(hash_file,'w')
     hash_file_create.write(sha1Hashed)
     hash_file_create.close() 
 shutil.copyfile(new_pac_filee,old_pac_file)
 subprocess.call("%s %s %s" % ('service', 'squid', 'reload'),shell=True)
   else:
 syslog.syslog(syslog.LOG_WARNING,"Hashes are same kutuphane_veritabanlari.squid config file hasn't been changed.")
else:
    hash_file_create=open(hash_file,'w')
    hash_file_create.write(sha1Hashed)
    hash_file_create.close()
squid_config_file.close()