WinRM Support for Server Monitoring

Configure the service account with Remote Management User and CIMV2 privileges.
Enable WinRM on the Windows server.
WinRM with Kerberos supports the aes128-cts-hmac-sha1-96 and aes256-cts-hmac-sha1-96 ciphers. If you want to authenticate using Kerberos and the server you want to monitor uses RC4, you must download the Windows update and disable RC4 for Kerberos in the registry settings of the server you want to monitor.
To open the ports on the Windows server for WinRM connections, enter the following command:
winrm quickconfig
and then enter
y
to confirm the changes. Then confirm that the output displays
WinRM service started
.
If WinRM is enabled, the output displays
WinRM service is already running on this machine.
and you will be prompted to confirm any additional required configuration changes.
Verify that WinRM communicates using the correct protocol by entering the following command:
winrm enumerate winrm/config/listener
For HTTP, confirm that the output displays
Transport = HTTP
.
For HTTPS, confirm that the output displays
Transport = HTTPS
.
(
HTTPS only
) Configure the server thumbprint to authenticate the server with the firewall.
Verify the certificate is installed in the Local Computer certificate store (
Certificates (Local Computer)
Personal
Certificates
).
Open the certificate and select
General
Details
Show: <All>
, select the
Thumbprint
, and copy it.
From the Windows server command prompt, enter the following command:
winrm create winrm/config/Listener?Address=*+Transport=HTTPS @{Hostname=”
<hostname>
";CertificateThumbprint=”
Certificate Thumbprint
"}
hostname
is the monitored server and
Certificate Thumbprint
is the value you copied from the certificate.
Make sure to remove any spaces in the Certificate Thumbprint to ensure that WinRM can validate the certificate.
Specify the authentication type and verify successful authentication between the server and the firewall.
For HTTPS with basic authentication, from the Windows server command prompt, enter the following commands:
c:\> winrm set winrm/config/client/auth ‘@{Basic="true"}’
winrm get winrm/config/service/Auth
Confirm that
Basic = true
.
For HTTPS with Kerberos authentication, from the Windows server command prompt, enter the following command:
winrm get winrm/config/service/Auth
Confirm that
Basic = false
and
Kerberos= true
.
Enable authentication between the PAN-OS integrated User-ID agent and the Windows servers you plan to monitor using WinRM.
From the firewall web interface, select

Device

User Identification

User Mapping

Palo Alto Networks User-ID Agent Setup

Server Monitor Account

.

In

domain\username

format, enter the

User Name

for the service account that the User-ID agent will use to monitor servers.

Enter the

Domain’s DNS Name

of the server monitor account.

If you are authenticating using Kerberos, Kerberos uses the domain name to locate the service account.

Enter the

Password

and

Confirm Password

for the service account and then click

OK

.



(

Kerberos only

) Configure the firewall to authenticate with the Windows server using Kerberos.

If you did not do so during the initial configuration, make sure you configured date and time (NTP) settings to ensure successful Kerberos negotiation.

Configure a Kerberos server profile on the firewall to authenticate with the server to monitor the security logs and session information.

Select the

Kerberos Server Profile

you created in the previous step and click

OK

.


Configure the PAN-OS integrated User-ID agent to use a WinRM transport protocol to monitor Windows servers.
Select the Microsoft server

Type

(

Microsoft Active Directory

or

Microsoft Exchange

).

Select the WinRM

Transport Protocol

.

WinRM-HTTP
—Use WinRM over HTTP to monitor the server’s security logs and session information. If you select this option, you must configure authentication using Kerberos.
WinRM-HTTPS
—Use WinRM over HTTPS to monitor the server’s security logs and session information. If you select this option, you must configure either basic authentication or authentication using Kerberos.

Enter the IP address or FQDN

Network Address

of the server.

If you are using Kerberos, the network address must be a fully qualified domain name (FDQN).


(
HTTPS only
) Import the certificate that the server uses for WinRM onto the firewall and associate it with the User-ID Certificate Profile.
The firewall uses the same certificate to authenticate with all monitored servers.
Select

Device

User Identification

Connection Security

and click

Edit

.

Select the Windows server certificate to use for the

User-ID Certificate Profile

and then click

OK

.


Commit
your changes.
To verify the configuration, verify that the status of each server configured for server monitoring is Connected on the
Device
User Identification
User Mapping
tab in the web interface.