topic Re: Prevented third-party VPN in General Topics

Prevented third-party VPN

Peter_Spec — Fri, 01 Jul 2016 10:01:43 GMT

As you write in https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os-release-notes/pan-os-7-1-2-addressed-issues for blocking third-party software, I still can't fix up this bug. I downgrade my FW as you told ( from 7.1.2 to 7.0.1) then upgrade again to 7.1.2, but I still can't connect with Androti VPN or. Cisco VPN Client to may FW. Global protect works fine.

What shell I do ?

Best Regard

Peter

Re: Prevented third-party VPN

kiwi — Fri, 01 Jul 2016 13:00:36 GMT

Hi Peter,

Have you tried the following solution/workaround :

PAN-OS-7-1-1-gt-GP-Xauth-does-not-work-Solution

I hope it works for you.

Kim.

Re: Prevented third-party VPN

Peter_Spec — Fri, 01 Jul 2016 13:10:02 GMT

Yes I did it, but don't works for me.

Any others idea?

Re: Prevented third-party VPN

kiwi — Fri, 01 Jul 2016 13:58:27 GMT

Hi Peter,

Depending if you upgraded directly to PAN-OS 7.1.2 or first to 7.1.x and then to 7.1.2 you might not have fixed the issue. It looks like the fix won't work if you upgrade to 7.1.2 from the same base version.

That specific issue you refer to was related to the fact that the OS did not accept os = any (lower case)... the workaround using the command I showed you earlier must be typed with "Any" (capital A) in order to work-around the issue.

You can also check in cli configure mode :

# show global-protect global-protect-gateway <gateway> client-auth auth-any

auth-any {

os Any; (working) >>>> as opposed to os any; (not working)

If it is capitalized and still not working then you might be facing a different issue and you might want to look further for details (ikemgr.log ?).

Cheers !

-Kim.

Re: Prevented third-party VPN

Peter_Spec — Mon, 04 Jul 2016 06:06:30 GMT

Hi KIm

Than you wery much. This was a perfect hint. Yes it's works.

I hade writen:

auth-any {

os Any;

but it did't works as you now. But I rewrite it again, commit a new/same setting and ''voila'' magic works.

Thank you very much for help.

Best regards

Peter

Slovenia