About ZEBIT

ZEBIT · ‎06-08-2020

Good idea. Forgot to check that. Will do and come back to you.

ZEBIT · ‎06-08-2020

Hi @kiwi I think I'm quit soft (too soft) in my policy. Here you can see screenshots of the whole policy + certficats like our partner implemented.

ZEBIT · ‎06-07-2020

Hi, We use a PA3260 with PanOS 9.0.7. Since 2 months our programmers have problems connection to Azure Devops. The always lose the connection several times a day. When they work from home there is no problem, so I think the problem is the firewall. I already searched in the monitoring for deny's or SSL decryption errors but can't find anything. After two three days of searching and programmers that are complaining I don't know what todo. So maybe somebody of you are having the same issues and a solution?

ZEBIT · ‎06-07-2020

Hi, We are using a PaloAlto 3260 with PanOS 9.0.7. We have configured SSL decryption wich uses a certificate signed by our own Windows CA server. Each client in our environment has the Windows Root CA. In the beginning (2 years ago) everything worked well. We could decrypt everything except everything in the category financial. But now latest months it seems I need to add a lot of websites for no decryption because otherwise the employees can't visit the website. It is getting frustrated and I'm think about disabling SSL decryption, but maybe you guys know an answer or solution. Thanks.

ZEBIT · ‎09-20-2018

We have some issues for some users with the globalprotect vpn to connect to our PA-3260 firewall. To solve this issue technical support told us to upgrade to our PanOS from 8.1.2 to 8.1.3. We did this morning and everything went fine till 1PM. From some users we received there was a connectivity issue to internet, other users told us they couldn't connect to servers public IP behind the firewall. Start troubleshooting the whole network we could see in our arp table of the router that mac-addresses of the firewall had an "incomplete" ip address. Looking further in this issue we found that the firewall didn't send any ARP messages anymore to any device and due that the external servers couldn't be reached through the router. We also found that GUI was reacting very slow. After 4 hours of troubleshooting with the technical support from the Palo Alto partner we decided to go back to version 8.1.2. We restarted the firewall and all the issues above were solved. I think Palo Alto need to have a look into the 8.1.3 release.

ZEBIT · ‎07-30-2018

We are migrating our Active-Passive PA-500 enviroment to an Active-Passive PA-3260 enviroment. In the PA-500 for the High Availability Control Link (HA1) was ethernet 1/7 and for the Data Link (HA2) it was ethernet 1/8. For the PA-3260 I can use HA1-A but for the Data Link I would like to use HA1-B but I'm only able to select the HSCI interface. Why is this ?

ZEBIT · ‎07-05-2018

Hi Luke, I have found the solution. First of all add the following addresses: update.sonos.com update-firmware.sonos.com After that create an allow rule for the AD group with destination the two addresses. When this is finished create a no decrypt rule to these two destination addresses. Software and firmware update like a charm 🙂

ZEBIT · ‎07-04-2018

Hi, We have something strange in our firewall. We have a client/computer with Sonos software and the software need to update. When we click update in the software we get a message that something is wrong. So I checked our firewall and in the monitor I can see that the update needs to get pulled from akamai and it is denied. So I created a rule that the user have the permission to access this website. The update is still not working and I can see that in the monitor my allow rule is hitted but the session end reason is policy-deny. How to fix this?

ZEBIT · ‎03-29-2018

The problem is in the PanOS version 8.1 and userID agent 8.1. UserID indentification does not work in the releases. If you use this in your company don't upgrade to 8.1.0

ZEBIT · ‎03-29-2018

I think I see what the problem is. I needed to install new UserID agents (8.1.0-66) and my users doesn't get mapped properly.

ZEBIT · ‎03-29-2018

But now it is set to a specific security group in our Active-Directory. I'm member of this group and it worked before! You solution works, but I would really like the Active Direcotry group.

ZEBIT · ‎03-29-2018

We have upgraded our firewall to version 8.1 and the GlobalProtect agent to 4.1. We use a certificate to authenticate with our GlobalProtect Agent but after the upgrade (8.0.5 and 4.0.3) nobody can't authenticate anymore. In the logs I always see this: First 'GlobalProtect portal user authentication succeeded. Login from: 10.1.2.10, Source region: 10.0.0.0-10.255.255.255, User name: STSCH@zeb.be, Auth type: client certificate.Client OS version: Microsoft Windows 10 Pro , 64-bit After: GlobalProtect portal client configuration failed. Login from: 10.1.2.10, Source region: 10.0.0.0-10.255.255.255, User name: STSCH@zeb.be, Client OS version: Microsoft Windows 10 Pro , 64-bit

ZEBIT · ‎03-05-2018

I found the solution. It is something stupid. I forgot to create policy rules which allows a connection from zone EXTERN to zone EXTERN with the application ipsec and ike.

ZEBIT · ‎03-05-2018

Hi theonewhoknocks, The status of the tunnel and IKE is red.

ZEBIT · ‎03-05-2018

We have two vpn Palo Alto devices. One in our HQ departement and one in a remote location. I need to setup an IPSec VPN tunnel between these sites with the Palo Alto devices but I never did this before. On the Palo Alto website I found this article which was helpfull https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-IPSec-VPN/ta-p/56535 but the devices does not connect with each other. Also for our remote location I only want that the traffic to our servers go into the tunnel but internet traffic does not. Second how can I configure to which server the clients of the remote sites can access? I need to get al this to work on Wednesday.

Member Since	‎04-16-2014 10:54 PM
Date Last Visited	‎11-06-2024 09:05 AM
Posts	72
Total Likes Received	7

Online Status	Offline
Date Last Visited	‎11-06-2024 09:05 AM

About ZEBIT

Re: Block known AD users from Guest LAN

Block known AD users from Guest LAN

Re: Workstations no internet after receive IP from firewall DHCP Server

Workstations no internet after receive IP from firewall DHCP Server

Re: Renew firewall CA certificate and distribute with GPO

Re: Wetransfer download site we.tl not seen as Wetransfer application

Renew firewall CA certificate and distribute with GPO

Re: Wetransfer download site we.tl not seen as Wetransfer application

Re: Wetransfer download site we.tl not seen as Wetransfer application

Re: Wetransfer download site we.tl not seen as Wetransfer application

Re: Problems connecting to Azure Devops

Major issue PanOS 8.1.3: Network intefaces go down

Re: Rule allowed but policy-deny?

How to setup multiple vpn?

Re: How to publish IIS website with static external IP address

Re: Problems connecting to Azure Devops

Re: SSL Decryption every day more exclusions

Problems connecting to Azure Devops

SSL Decryption every day more exclusions

Major issue PanOS 8.1.3: Network intefaces go down

PA-3260 High Availability

Re: Rule allowed but policy-deny?

Rule allowed but policy-deny?

Re: GlobalProtect client can't authenticate anymore after upgrade to 4.1

Re: GlobalProtect client can't authenticate anymore after upgrade to 4.1

Re: GlobalProtect client can't authenticate anymore after upgrade to 4.1

GlobalProtect client can't authenticate anymore after upgrade to 4.1

Re: Configure IPSec between Palo Alto devices

Re: Configure IPSec between Palo Alto devices

Configure IPSec between Palo Alto devices

Unlock your full community experience!

About ZEBIT