Microsoft Windows 8 Store and PANOS 4.1.7.

[UAMSITSEC]

We recently upgraded our HA Active-Passive pair of PA-4060's from v3.1.9 to v4.1.7. In addition to resolving some minor issues with changes in the codebase, we have noticed now that our minority of users with Windows 8 workstations (Beta, Release Preview, and TechNet/MSDN RTM installs) are unable to download apps from the Windows 8 Store. I have reviewed the firewall logs and do not explicitly see any obvious denials in traffic from the affected workstations. Is anyone else experiencing similar issues, and might anyone have any suggestions regarding if I may be overlooking something? Thanks in advance.

Kevin

[mikand]

Do you have ssl-termination turned on?

Perhaps you need to "whitelist" the win8 appstore stuff the same way as with windowsupdate?

[UAMSITSEC · Accepted solution]

Well, after performing further searches, I can remove the PA's from being at fault. Apparently, in Windows 8 there is a group policy option called "Network Isolation under the Computer Configuration - Administrative Templates - Network section. It appears that if there is an advertised proxy server upon your network, and regardless of the Windows 8 IE 10 proxy settings set to be disabled, the Windows 8 Store by way of the Network Isolation will still attempt to route the Store traffic through the proxy. The reason for the denial is the configuration of the proxy does not allow unauthenticated traffic to pass. So, I'll be diverting my attention to our TMG proxy server for the time being. Thanks for the prompt reply mikand. Have a great weekend!