topic Re: GoToMeeting no longer working, http-proxy blocked in General Topics

GoToMeeting no longer working, http-proxy blocked

scottsander — Wed, 26 Apr 2017 13:05:57 GMT

I'm using PAN-OS 7.1.8 on a active/passive HA cluster of PA-3050 devices for the perimeter. Just recently, people started complaining that GoToMeeting no longer works. When I investigate a test session (http://help.citrix.com/getready), the session does not start. When I look in the PAN-OS monitoring logs, I am seeing "http-proxy" being blocked. I created a temporary rule that allowed me access to that application and, after doing so, GoToMeeting worked fine.

We block and have always blocked the http-proxy application in our web filtering rules for everyone. Does anyone have any suggestions for how to get GTM working without opening up http-proxy for everyone? Is this something that should go to PAN support?

Re: GoToMeeting no longer working, http-proxy blocked

BPry — Wed, 26 Apr 2017 13:57:25 GMT

The easiest way to do it would be to allow it through o GotoMeetings IP address range so that you would be relatively positive that they still couldn't actively start a proxy session to bypass your security measures. I imagine that Palo Alto is probably working on updating the signature but you may want to contact TAC just to make sure.

Re: GoToMeeting no longer working, http-proxy blocked

Jsitter — Wed, 26 Apr 2017 21:52:18 GMT

Ran into this exact same issue this week. I'd be interested in hearing what support tells you.

Re: GoToMeeting no longer working, http-proxy blocked

scottsander — Thu, 27 Apr 2017 12:36:13 GMT

I never did call support but I found that if I excluded the Citrix-related IP addresses from TLS decryption that it worked. I'm not sure if Citrix changed something or PAN did, but it doesn't seem to work correctly with TLS decryption in effect. Keep in mind that the G2M launcher kind of breaks and stays half alive. You have to kill all the process that start with "g2m" and try again. Otherwise it looks like your changes in the PAN firewall aren't having an effect.