About S.Cantwell

S.Cantwell · ‎12-12-2019

Well, I think there may be some truth in what both @Mick_Ball and @Lukas.Schmitz are saying. HIP objects and HIP Profiles CAN be created under the Object tab. In the GP-Gateway configuration, you can do a HIP check AT the Gateway to allow the GW to inspect the client. So @Mick_Ball is correct... in the sense that the Gateway will be connected to.. but NOT terminating (or allowing the VPN) to be established until AFTER the HIP check is completed.

S.Cantwell · ‎12-12-2019

I think it relies on cached credentials to have the VPN succeed. Now... *could* PANW take your credentials from your login, and put them into GP... maybe (but that is a feature request...) 😛 So for now, it is working as engineered, and so no, I am not aware of aware of auto copy/paste the creds into the GP portal.

S.Cantwell · ‎12-12-2019

Interesting question. I would say there is no real apparent pattern, but it does seem to somewhat (and very loose interpretation) to say that the session browser is showing open/outstanding sessions that have not yet closed. Whereas what started as a new session (WebEx) but not end for hours (because of audio/video, etc), but there is also other web-browsing and DNS sessions that start and stop, it appears that the list gets out of order. BUT.. if you sort/filter on a specific application, you may sort of see a pattern emerge. I would say, that my screen capture shows my .6 camera has established the longest/oldest connection on my FW. Next followed by my .7 camera, newer by 2 secs. But my .8 camera did not establish until yesterday. Then for the other 2 entries, it is a same app, but different rule, so again, oldest one is showing below the newest one. So, maybe you need to create some filters around to see/interpret what I am saying.

S.Cantwell · ‎12-12-2019

Hello. Making progress though right? 😛 Not really. I think I realized that I isolated you now, with vlan10 and vlan20 not being able forward arp/broadcast traffic. So... back to original idea of 2 ports in a single L2 vlan on the FW. So if PC1 is on port1 and PC2 is on port2 (both ports in same vlan on FW) then the following should happen. PC1 attempts to ping PC2. Not knowing his L2 mac address, he will arp out (broadcast) Traffic ingress switch, egresses out the trunk port. Aggregation switch should fwd (untagged tag) packet to port1 of FW. FW will/should allow broadcast to go out port2 and reverse down trunk to PC2. Once arp resolution is determined, then security policy should be something like like SZ (fw_vlan) SA (PC1) ==> to DZ (fw_vlan) DA (PC2) ==> app of ping ==> application-default a ==> ALLOW next rule is SZ (fw_vlan) SA (PC1) ==> to DZ (fw_vlan) DA (ANY) ==> ANY ==> ANY ==> DENY If you missed this rule, then the intrazone rule is what you hit and allowed you to ping PC3 This may be exactly what you had (and I would apologize for going down a rabbit hole... 😛 You would need to look at your traffic log to see/confirm that the traffic from PC1 is hitting PC2 and also confirm.if traffic is passing and then denying for PC1 to PC3 traffic. Let us know.

S.Cantwell · ‎12-11-2019

I am not using the solution you provided, but from a WF perspective, you can always change the verdict from malicious to benign. The FW and WF solution is working as expected. You WANT the WF to filter out malicious traffic. What I would probably do (if this is a training environment) is simply NOT have a WF profile attached to the inbound mail rule, now WF cannot prematurely filter those out. Just trying to helpful. 😛

S.Cantwell · ‎12-11-2019

If you can schedule for later in day (after 4pm EST) that works best for me. I have Zoom. email me at steven.cantwell@cloudharmonics.com and I will schedule it.

S.Cantwell · ‎12-11-2019

Hello Your issue is that you created a single vlan on the FW, and associated both interfaces to that vlan. The put the zones into the same vlan. You should create 2 vlans on the FW and put vlan10 in PC1 zone, and vlan20 onto PC2

S.Cantwell · ‎12-11-2019

Hello These 2 types of accounts are already created as custom role based admin accounts. You can either use the permissions defined in them or create new custom permissions.

S.Cantwell · ‎12-11-2019

Hi John A few things (that you are already aware of...) but need to shed light on them. The state of the VPN on the PANW side is state: init Meaning that the PANW is attempting to xmit traffic to setup the tunnel. This does not make sense if you stated that proxyID is working. You cannot have an "init" on a firewall with a working VPN. What am I missing. Do you have time for an actual phone call.. You can send me a PM and we can take a look at this. If you have remote desktop (zoom, webex, etc) that would be great as well. Let me know.

S.Cantwell · ‎12-11-2019

Hello If you ISP gives you both public IPs, then their network should support using a single IP address. If one link fails, the traffic should use the 2nd link, and the ISP should know to send the traffic back to your FW. You should talk with your ISP to confirm this. We can try to translate our comments into your language.

S.Cantwell · ‎12-11-2019

Are these 3 proxy ids identical on the Cisco side, or perhaps you super-netted them? I do not see any info (or rather, not enough info) in your snippet of logs to confirm that proxyID2 is not up and operational. Do you have anything to show us errors/warning/messages surrounding this. Lastly.. (and may this is the key) You have 3 static routes, pointing to tunnel.8 (yes)? Again, we do not have the screen captures to confirm this. Please advise and lets keep working on this. 😛

S.Cantwell · ‎12-11-2019

My recommendation is use a client certificate, installed on the Linux computer, that will allow only that computer to authenticate. https://docs.paloaltonetworks.com/globalprotect/8-1/globalprotect-admin/authentication/about-globalprotect-user-authentication/supported-globalprotect-authentication-methods/client-certificate-authentication.html It is recommended that you have a Global Protect Gateway license, and if you do, then you can do host information profile checks, that indeed, would use the OS and/or a serial number as an "inspection" prior to being able to gain access to the VPN. https://docs.paloaltonetworks.com/globalprotect/7-1/globalprotect-admin/use-host-information-in-policy-enforcement/about-host-information Please review this doc and let us know if there are any questions.

S.Cantwell · ‎12-10-2019

To the best of my knowledge, I do not believe those fan trays are FRU (field replaceable units).... Please advise if I am incorrect. If there are, there should be a document on how it is done, or contacting PANW TAC support. Good Luck.

S.Cantwell · ‎12-10-2019

What do your system logs show when both proxy ids are configured. Clearly, there is a mis-configuration on the FW, whether it is through logic or anomaly. We just need to see more info to help. Because we do not have access to your network, and there are millions of RFC1918 private networks, can you please show us the proxy IDs that you have configured, so that we can better understand your query? Also, I am presuming you have a single VPN with 2 proxy ids, versus 2 separate tunnels with overlapping proxy ids, which is not permissible. This is why we should see all VPN proxy IDs for each tunnel interface you have configured. Thanks.

S.Cantwell · ‎12-10-2019

So... there are many questions to your query. You could look at your system logs and determine the cause of the why the VPN goes down. Now, the default ike crypto file is configured to renegotiate at 8 hours... Can you (or have you enabled) IKEv2 to take advantage of the higher timer? Have you confirmed IF the OCI can be configured to increase its timer, beyond 8 hours? Have you looked at your global counters to confirm if you are seeing fragmented traffic? Do you have a Zone Protection profile (getting warmer...) that may be dropping fragmented traffic? These are what I would start to look at first. Keep us in the loop. 😛

Member Since	‎05-10-2019 01:48 PM
Date Last Visited	‎02-18-2026 07:03 PM
Posts	963
Total Likes Received	210

Online Status	Offline
Date Last Visited	‎02-18-2026 07:03 PM

About S.Cantwell

Re: Kerberos SSO Admin with 2 devices

Re: Kerberos SSO Admin with 2 devices

Re: Cannot Access Global Protect Portal

Re: Regarding the Operational Specifications for HA Mode

Re: NGFW admin account is locked. What should I do?

Re: How to Patch Vulnerability - Plugin 43160 (CGI Generic SQL Injection) on GlobalProtect

Re: Tunnel Monitoring

Re: Introducing Expedition 2 Beta [Program Concluded]

Re: Service Connection Redundancy

Re: global protect vpn client -> microsoft edge -> pick an account - multiple microsoft-accounts and member of different m365 tenants

Re: Cannot Access Global Protect Portal

Re: Tunnel Monitoring

Re: Service Connection Redundancy

Re: Panorama: Device group can't view addresses nor zones in sec policies

Re: Error 1006

Re: Cannot see Dynamic IP lists

Re: Role-based access does not provide all menu options

Service outages and notifications

Re: PA Packet Capture

Re: Not able to view Anti-Virus updates under dynamic updates

Re: HIP Profiles in Global Protect

Re: GlobalPotect initial login

Re: Order of entries in the session browser or show session all command

Re: security policy between layer 2 zones

Re: KnowBe4 Phishing Training and WildFire testing

Re: VPN Proxies

Re: security policy between layer 2 zones

Re: Query about admin credentials

Re: VPN Proxies

Re: ECMP with one IP on outgoing

Re: VPN Proxies

Re: Restrict GlobalProtect connection from a single Linux computer

Re: Replace PA-850 FAN tray modules

Re: VPN Proxies

Re: VPN goes down each 8 hours

Nebula Beta

Unlock your full community experience!

About S.Cantwell