topic Re: What does it change in 'service route configuration' that Use kerberos for Global Protect?? in General Topics

What does it change in 'service route configuration' that Use kerberos for Global Protect??

KiCheon.Lee — Sun, 12 May 2013 23:09:33 GMT

Hello all,

I use kerberos auth for Global Protect on PANOS-4.1.x.

Remote users fail auth for GP connection that it appear 'invalid username'.

So I want to collect PCAP on kerberos server and PA device.

I know that PA use mgmt interface for communicated kerberos.

I want to change interface from mgmt for collected PCAP.

What does it change in 'service route configuration'???

Thank

Re: What does it change in 'service route configuration' that Use kerberos for Global Protect??

emr_1 — Mon, 13 May 2013 00:19:38 GMT

The protocols that you can't select from left side of Service Route Configuration should be controlled by right side.

You can't choose source port for kerberos in left side.

Regards,

Re: What does it change in 'service route configuration' that Use kerberos for Global Protect??

KiCheon.Lee — Mon, 13 May 2013 04:22:48 GMT

Hello emr,

You assist my question, again.

Thank you for always help me.

I have a question, more.

If I install all side (left and right) in service route configuration.

Does the device process left side rather than right side?? or Does it process right side rather than left side???

Regards,

Re: What does it change in 'service route configuration' that Use kerberos for Global Protect??

emr_1 — Mon, 13 May 2013 11:12:11 GMT

According to my test result, if I configure both left and right for panupdates, it couldn't reach to updates.paloaltonetworks.com.

I think you should not configure both.

Regards,

Re: What does it change in 'service route configuration' that Use kerberos for Global Protect??

mr.linus — Tue, 04 Jun 2013 15:06:39 GMT

Dear Cheon,

Since you can not choose a service or application for routes on the right side: it is for all traffic!

And it will overrule all settings set on the left.

Ex. DNS server and Kerberos server are same server

LEFT SIDE:

Service: DNS

Source Address: MGT

RIGHT SIDE:

Destination: IP of your kerberos server

Source Address: IP of your internal interface

=> DNS traffic wil NOT use the MGT interface, but hit on the right side route rules and use you internal interface as source...

But I guess since its going to the same server you would probably want to use the same source Address, but you never know: something to keep in mind....

Regards,

OCSP service route?