About mgusta

Hi,   Yes, I did set the zones and public IP of Exchange server. I did notice that using application default in our environment didn´t work since web-browing is only allowed on port 80 by default and we do a redirect to HTTPS. So for the test I used 'any' for service which I would restrict if I decide on implementing this. But you would say that decrypting this traffic and allowing those applications is better(=safer) than just letting it pass through as SSL?   Thank you for you input on this.   //Mikael ... View more

When I got home last night I discovered that the setup didn´t work as I expected. When there is no external GW present in the agent configuration it doesn´t try the next agent config for that user. So I couldn´t log in at all from home (next agent config was set to on demand and I expected to be able to use it). Now I´m leaning at forcing all traffic, always, through our firewall. But I don´t like the idea of our local network being accessible by default when a user logs in when out of the office so I created a new security zone for the automatic external gw without acces to lan resources. Then I added another gw for full access and ticked it as manual. Now all surf traffic gets routed through PA by default and the users has to make a manual choice to connect to the local resources. To further strenghten the security I would like to force the users to enter their credentials when switching to the full gw but I don´t think thats possible since portal config is set to SSO. I´ll try to uncheck SSO and see what happens but my prediction is that they´ll have to authorize them twice (first windows then GP) and that won´t be happily accepted. Your solution would work but the problem is that when the agent can´t reach the gw to connect you get a baloon notification every 5 sec saying "not connected" which I haven´t found a way to disable. Well you can disable it by not showing icon in taskbar but then the users has no way to temporarily disable the client which sometimes is necessary because they need to connect to printers on the road or they´re on a network which isn´t letting vpn traffic through. //Mikael ... View more

Ok, now I´ve managed to get the agent to automatically connect at logon when the client is on our wifi. I created a new Agent Configuration under the portal. I left external GW blank and added our usual GW address under internal GW. As internal host check I had to use a DNS address reachable both from the wifi and our lan (I don´t have any dns server, local to the wifi, that can respond to the nslookup PA performs for internal host detection). This means that the agent connects and creates a tunnel even when connected by wire. I´m not sure if this will prove to be an issue or not. This far I haven´t found any downsides, but I guess since all traffic now flows through the PA device there could be bandwidth problems when more users are included in the setup. ... View more

I´ve opened a case with PA on this and provided them with the data necessary. I´ll post back here if they come up with a solution, or at least a cause... ... View more

But that would require the end user to manually change the portal adress in the client?. Or maybe I could NAT them to the correct portal depending on the zone they connect from. I will try different methods to achieve this and find the best solution our environment. Thanks for your input. ... View more

Hi again, I was thinking a bit more on your solution and doesn´t it mean that they will automatically connect to the external portal when not on our network or wifi? Or can an add a new client config at the bottom of the list of configs (I have both split and full tunneling depending on AD group) with only an internal gateway configured (no external) and internal host check enabled? Thanks, Mikael ... View more

I´m on 6.1 and still get kicked out. But we experienced that even from earlier versions <6.0. I was told by our reseller that they have the same issues. Anyone come up with the reason for this behavour? ... View more

Thank you, I will try this. A bit complicated perhaps but I feel it will give me what I was asking for. Best Regards, Mikael ... View more

Well I do have an internal CA and a GP licence plus the GW subscription. So I can set it up that way. Can I force the laptops to pre-authenticate using the computer cert when, and only when, connected to our local wifi? I don´t want to force them through our portal when they´re on the road since it´s a full tunnel set up so there could be bandwidth issues. ... View more

Hi, Tack för ditt svar. Yes, I have a specific zone for wifi but I would like to apply different policies to that zone based on what kind of client´s being used. If the client is a Corporate owned laptop I wan´t the same restrictions (facebook, dropbox etc.) to apply as if they were inside our network. The only way I know of is using a HIP-profile but that requires the users to authenticate to our portal first, which I don´t want. Captive portal might be one way to go about it. I guess I could identify the type of device then? //Mikael ... View more

Gavin, I just tried this setup myself and it works fine, as you said. I´m thinking that there are alot of other applications, besides Google-Search, that are identified by PA as web-browsing which use port 443. So adding the application google-search would only solve one problem. What i´d recommend them to do is to either add port 443 as a default port for web-browsing or give the users the ability to add it themselves. I guess this could be done by creating a custom app with the same signature as web-browsing but port with 443 as an addition (again, theory haven´t tried it). I´m not sure if there are any security concerns with adding port 443 though. ... View more

I don´t think that will work. At least it doesnt in my setup. Adding SSL allows port 443 but only if the application is recognized as SSL. My problem, and Gavins, is that the application is recognized as "web-browsing" but on port 443. One work-around would be to add a separate policy for application "web-browsing" and add service http and https. This way other application are only allowed on their default ports except for web-browsing. This is in theory, I haven´t tried it yet. 🙂 ... View more