General Topics

Global Protect IPSec/SSL

Hello, If global protect fails to establish a IPSec tunnel and uses SSL instead, does it attempt to switch tunnel types if it sees it can do a IPSec tunnel or will it keep it's current tunnel type until the GP client get's refreshed and sees what connection it can establish? The reason I ask is because Global Protect is extremly slow when it us...

URL Filtering with no block page

Is it possible to have URL filtering by category with just a quiet drop of traffic, no reset or block page? Basically I want to filter without people knowing I am filtering, they just can't connect to a bad website. I can't figure out how to do that; everything looks like URL filtering requires some sort of response page.

Resolved! Identify Policy Deny Source

I am seeing some decrypted sessions hitting an allow rule, but the session end reason gets logged as a "policy-deny". Here is a screenshot of one example:In the above example, rule "outbound" is configured as:Source Zone: MSUNSource Address: AnyDestination Zone: CharterDestination Address: AnyApplication: AnyService: AnyAction: AllowSecurity Pr...

Resolved! Authentication error Gprotect

Hi, we have a cluster of PA5020 with PanOS 7.1.12. Yesterday we had a problem, the Global protect authentication was failing. So we failover the cluster and it worked again. Today this problem has happened again. Looking in bug we could be hitting this bug. So i would like to confirm if we are hitting this bug. How could we check "proxy memory"....

Seek for help: Failure to use Global Protect VPN

I came into a problem for global protect VPN connection, could anyone please help me? After installing of the GlobalProtect64.msi program(finished installtion), it didnot work on my computer(cannot establish connection, windows 8.1, 64 bits system). I checked log files"debug_drv.log": [Info 297]Driver inf file is installed successfully.[Info 327...

Multi site dual-isp with redundant VPN connections: PBF vs alternatives?

When we got out PanOS firewalls a few years back, we set them up with a single virtual router and PBF to handle our active/passive ISPs. Time went on, and to support fancier topologies, such as fully redundant VPN connections between us an AWS, we moved to dual VRs: one default that holds all our routes AND the standby ISP, and one that pretty m...

Computer wakes up

Hello,My laptop which is couple of months ol runs win 10 is constantly turning on when in sleep mode. Any advice and what causes this?

Resolved! Educator at Heart - Jobs for trainers PCNSE certified?

About to take the PCNSE in a few weeks. I don't mind being a consultant, but I like training the most. Are there many jobs out there for PCNSE certified individuals interested in training, and if so where are they needed most? Also, what is the salary that is fair in expectation if you may know? Thanks!

Resolved! PANOS 8.0.7 SSL inbound inspection affects SSLLabs scroe

Hi, When we do SSL inbound inspection for some of our web servers, SSLLabs test scores goes from A+ to B. I also tested with "openssl s_client -connect mailadmin.artvin.edu.tr:443 -showcerts" and it show the same problem. The problem is, when doing ssl inbound inspection, both SSLLabs test and openssl test shows "Secure Renegotiation IS NOT supp...

Resolved! How to export sample miner from minemeld app in autofocus

Hi experts, I have a customer who uses Autofocus with Minemeld and, uses splunk. This customer is using two minemeld. One of Minemeld is from Autofocus app and, another is Standalone Minemeld deployed on Splunk. but, I found out difference number of miner samples between Autofocus app and Standalone Minemeld. Below is number of samples wh...

After installing update 8.0.8 PA3020 in FIPS\CC mode inaccessible. Device stuck in boot loop.

After installing update 8.0.8 on a couple of our PA 3020s they became inaccessible using the web access and SSH. We had to do a factory reset on the devices. Every time we tried to put the devices back into FIPS\CC with 8.0.8 installed the devices would get stuck in a boot loop. We had to do a factory reset and reinstall version 8.0.7. Then w...

Destination NAT not working

Hello all, I am having issues with my NAT config. I have everything from this doc completed but not seeing any traffic hit my outside interface in the logs.https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/networking/nat/nat-configuration-examples/destination-nat-exampleone-to-many-mapping I basically have a Synology NAS im trying ...

Resolved! Policies > Tunnel Inspection

Hello Does any one have example of how to configuring tunnel inspection in GUI under the policy tab. Thank you

Resolved! GlobalProtect and general Internet access?

Hey folks, Using PAN-OS 7.1.15 and Globalprotect client 4.0.1. Trying to confirm something. From what I can tell, when connected to VPN via GlobalProtect, my general internet access goes through the VPN tunnel route successfully (after security rule between the zones of course). That is the case, correct? Split tunnel is just not available or ...

List of Service Accounts

Does anyone have a running list of service accounts used/needed for best practices? User-ID (per domain or per domain trust)LDAP profile (per domain for Group Mappings) What else?

Discussions

Global Protect IPSec/SSL