topic Re: Global Protect 1.2 & HIPS in General Topics

Global Protect 1.2 & HIPS

DaveM — Thu, 13 Dec 2012 11:39:11 GMT

Hi,

Has anyone seen any problems with GP 1.2 and HIPS, particularly the domain check? Since upgrading to 1.2 the HIPS check we have to determine if the PC is a member of specific domains fails. When we look at the client on a PC (running windows 7) it no longer shows the domain under the host info section? It still shows the OS and Host Name as well as AV, NIC's etc but nothing about the domain.

Thanks

Dave

Re: Global Protect 1.2 & HIPS

BrutalDismount — Thu, 13 Dec 2012 18:57:07 GMT

I see this with my installation of 1.2. however I do see it being populated correctly on the firewall HIP Match.

Re: Global Protect 1.2 & HIPS

DaveM — Fri, 14 Dec 2012 11:31:29 GMT

I seem to be getting odd results with the firewall rule - it seems a bit hit and miss but certainly not consistent, I'm seeing some users hit rules further down the rule base rather than get matched by the rule with the HIP check. The HIP match rule on the gateway which uses the same HIP profile is displaying the not matched message for all my users who are on the 1.2 client.

Re: Global Protect 1.2 & HIPS

mikand — Sat, 15 Dec 2012 09:44:26 GMT

What if you run the "test" command in cli?

Will it be random aswell on which rule it will hit?

Re: Global Protect 1.2 & HIPS

DaveM — Mon, 17 Dec 2012 15:35:38 GMT

Do you have the syntax for the command?

Re: Global Protect 1.2 & HIPS

mikand — Tue, 18 Dec 2012 09:08:43 GMT

Depends on which PANOS version you have, but check the "CLI Reference Guide" over at

Re: Global Protect 1.2 & HIPS

DaveM — Thu, 27 Dec 2012 14:45:22 GMT

It actually looks like from 1.2 onwards the HIP check for the Domain no longer looks at the Host Domain of the PC you are connecting from but the Domain of the user authenticating with the global protect client. We where using this to restrict users with non company devices but with a domain account to specific applications, IP ranges etc. - This change has unfortunately broken this functionality for us.