Prevented third-party VPN

[Peter_Spec]

Hi

As you write in https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os-release-notes/pan-os-7-1-2-addressed... for blocking third-party software, I still can't fix up this bug. I downgrade my FW as you told ( from 7.1.2 to 7.0.1) then upgrade again to 7.1.2, but I still  can't connect with Androti VPN or. Cisco VPN Client to may FW. Global protect works fine.

What shell I do ?

Best Regard

Peter  

[kiwi]

Hi Peter,

Have you tried the following solution/workaround :

PAN-OS-7-1-1-gt-GP-Xauth-does-not-work-Solution

I hope it works for you.

Kim.

[Peter_Spec]

Yes I did it, but don't works for me.

Any others idea?

[kiwi · Accepted solution]

Hi Peter,

Depending if you upgraded directly to PAN-OS 7.1.2 or first to 7.1.x and then to 7.1.2 you might not have fixed the issue.  It looks like the fix won't work if you upgrade to 7.1.2 from the same base version.

That specific issue you refer to was related to the fact that the OS did not accept os = any (lower case)... the workaround using the command I showed you earlier must be typed with "Any" (capital A) in order to work-around the issue.

You can also check in cli configure mode :

# show global-protect global-protect-gateway <gateway> client-auth auth-any

auth-any {

  os Any;    (working)      >>>> as opposed to os any;   (not working)

If it is capitalized and still not working then you might be facing a different issue and you might want to look further for details (ikemgr.log ?).

Cheers !

-Kim.

[Peter_Spec]

Hi KIm

Than you wery much. This was a perfect hint. Yes it's works. 

I hade writen:

auth-any {

  os Any;  

but it did't works as you now. But I rewrite it again, commit  a new/same setting and ''voila'' magic works.

Thank you very much for help.

Best regards 

Peter

Slovenia