About COlson

COlson · ‎06-22-2022

Hello, Turns out there's a key part of using HIP matching that should probably be mentioned first instead of buried deeper in articles; you need to have User-ID enabled on the zone. Once that was enabled it worked fine.

COlson · ‎06-08-2022

Hello, I am testing out using HIP match for certain traffic but I am running into an issue where traffic continues to be blocked. I can see the HIP information in the log and firewalls has GP Gateway license. Originally tried to use HIP for just Anti-Malware 'Is Installed' and has 'Real Time Protection' and the traffic never passed even though in the HIP log I can see both of these being good. So then I just tried to use host information and host contains "Microsoft" (I am using a Windows 10 machine to test) and again traffic fails despite the HIP log showing the machine is Windows 10. If I remove the HIP profile from the security policy, the traffic passes without issue. I have now tested with different categories in the HIP object, testing different client machines to see if something was unusual but it doesn't matter, if the HIP Profile is in use, traffic is blocked. Is anyone familiar with what might cause the HIP information to match but traffic still not pass as expected? Thank you.

COlson · ‎04-23-2022

Hi, I could set it to IKEv2 only but the same problem arises; as soon as the the two firewalls are on different versions of PAN-OS, IKEv2 fails. I would have thought that would be the use case for IKEv2 preferred but it doesn’t seem it.

COlson · ‎04-13-2022

Hello, I’ve recently ran into an issue where I’m using IKEv2 preferred and the two firewalls are using different versions of PAN-OS. It will fail with “invalid sig.”. If both firewalls are the same PAN-OS version (this has been happening on 9.1.11-9.1-13h3… I don’t have any other versions to test), it works fine. But since I can’t update all firewalls at the same time, there are periods of time where they are different versions and that results in the tunnel dropping. Additionally, as I’m using IKEv2 preferred, I assumed that when IKEv2 failed, it would use IKEv1 but that doesn’t seem to be the case. Are both of these expected behaviors? There must be something I am missing. Thanks.

COlson · ‎01-07-2022

Hello, I am trying to troubleshoot an error in a traffic log regarding cert decryption. I have found an article from PA on it: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boONCAY but I am unable to reproduce the steps to help in troubleshooting. The fourth bullet says 'Dataplane Debug shows the following..." and I would like to see a log just they show in the example but I'm not sure where that is. The log features it references I'm familiar with for packet capture but packet capture doesn't look the example they provided. Can someone point me in the right direction of how I can reproduce that screen? Thanks.

COlson · ‎12-07-2021

Hello, I’m in the middle of trying to make a gateway for iOS devices and I’m having an issue. I use MobileIron to push out the config and it uses an MI SCEP cert; I’ve added the MI SCEP CA to the PAN device and set it up as the auth profile. If I only do UN/PW I have no issue but as soon as I add cert requirement, the iPhone GP app has an error and if I check the PAN traffic log I see my phone IP traffic behind denied with a session end reason as “decrypt-cert-validation.” Based on what I have been able to read, this might be due to a cert not being X509 compliant. Can anyone help me understand what specifically is required in the cert or does anyone have any experience with this issue/config? Thanks in advance.

COlson · ‎01-14-2021

@BPry , Thank you for the suggestion. I have done this before but tend to see inconsistent/unexpected results. So, following your advice, I did this for the the statics.teams.cdn.office.net; created a Custom URL CAT, added it as a FDQN inside of that. In the security policy, allowed the desired apps, ports, Destination ANY and that custom URL CAT. The rule does work, Teams downloads but I also see the rule several times hitting IP addresses that don't reverse to the aforementioned FQDN. Based on GeoDNS with Akamai though, you believe this is expected behavior?

COlson · ‎01-13-2021

Hello all, I'm trying to fine tune a security policy to allow MS-Teams to update; based on what I can see the logs, it seems to contact statics.teams.cdn.office.net for the update. I have created a single policy with that destination as a FQDN, allowing the usual ports and applications. However, the rule is never hit, it skips over it and hits a deny rule. When I check the URL Filtering logs, it does indeed show that it hits statics.teams.cdn.office.net but the destination IP is completely different than any ping, nslookup, PAN resolve, etc... to that FQDN and I can't figure out why the IP doesn't match what returns for that FQDN. Does anyone have any experience with something similar or even a better way that I might be able to allow Teams to update through the application itself? Thank you.

COlson · ‎12-10-2020

Based on what you're showing, it would seem that GPO would indeed take a precedence; which makes the DNS suffix option not useful. Although, I'm unable to find it anywhere in their documentation that confirms or denies that.

COlson · ‎12-10-2020

DomainA and DomainB DNS suffix are received via GPO.

COlson · ‎12-10-2020

I had read that as well... but unfortunately, it doesn't seem to be adding the suffix. It's not resolving properly. So, my laptop is in domain A and receives DNS suffix for domain A and domain B. GlobalProtect has a DNS suffix for domain C. So when I connect to the GP gateway, I want to be able to resolve hostnames for domain C without FQDN but when I ping hostname, Wireshark shows DNS is trying hostname.domain A and hostname.domain B (which fails because the hostname is only in domain C) and then returns that the host can't be found.

COlson · ‎12-10-2020

When I do a ping hostname and look in wireshark, I see the DNS request to the proper DNS server but it uses the DNS suffix from the local machine (there are actually two and it tries both), not the DNS that should be applied via GlobalProtect.

COlson · ‎12-10-2020

Hi, I have added the DNS suffix under Gateway-->Agent-->Network Services. And I see the same thing in the log that you posted, the DNS suffix shows as being processed, but when that DNS suffix does not show up ipconfig or in the adapter settings for GlobalProtect and when I try and contact by hostname only FQDN works. So it's as though the config for DNS suffix is processed but never actually applied as far as I can see.

COlson · ‎12-08-2020

Hello, I have deployed a GlobalProtect gateway in an office that uses a different domain than our own. To that end, I have added their dns suffix to the gateway but when I connect onto that gateway, the suffix is never appended. I cannot access their domain resources unless I use FQDN. In the logs, I see the config being sent and it does include the DNS suffix so I'm not sure why it won't be appended? Thanks.

COlson · ‎12-07-2020

I was able to get this work but only by doing an override on the local PAN. The settings are exactly the same as I used in Panorama but they only worked once I overrode the service route config. Thanks.

Member Since	‎05-10-2019 02:15 PM
Date Last Visited	‎03-20-2024 10:33 AM
Posts	25
Total Likes Received	2

Online Status	Offline
Date Last Visited	‎03-20-2024 10:33 AM

About COlson

Re: GlobalProtect HIP issues

GlobalProtect HIP issues

Re: Site to Site VPN failing when IKEv2 and different PANOS

Site to Site VPN failing when IKEv2 and different PANOS

Debug Dataplane Help

GlobalProtect iOS Certificate issue

Re: MS-Teams Update Security Policy Help

MS-Teams Update Security Policy Help

Re: DNS suffix not applying

Re: DNS suffix not applying

Re: Service Route Help

Debug Dataplane Help

Re: Content Update Issue

Re: GlobalProtect HIP issues

GlobalProtect HIP issues

Re: Site to Site VPN failing when IKEv2 and different PANOS

Site to Site VPN failing when IKEv2 and different PANOS

Debug Dataplane Help

GlobalProtect iOS Certificate issue

Re: MS-Teams Update Security Policy Help

MS-Teams Update Security Policy Help

Re: DNS suffix not applying

Re: DNS suffix not applying

Re: DNS suffix not applying

Re: DNS suffix not applying

Re: DNS suffix not applying

DNS suffix not applying

Re: Service Route Help

Unlock your full community experience!

About COlson