About dmifsud

Hi @aleksandar.astardzhiev,   That setting can also be deployed in the registry without reinstalling GP: User Behavior Options (paloaltonetworks.com)     PORTAL AGENT CONFIGURATION WINDOWS REGISTRY/ MACOS PLIST MSIEXEC PARAMETER DEFAULT Allow User to Continue with Invalid Portal Server Certificate can-continue-if-portal-cert-invalid yes | no CANCONTINUEIFPORTALCERT INVALID= ”yes | no” yes   Regards, - DM ... View more

Yes this is from the Firewall CLI.   - DM ... View more

VPN I have the setting for Username/Password OR Certificate. This setting is for setting the client authentication behaviour and not related to the error you are getting.   That error means you don't have the Root CA trusted for whichever cert you are using for GP. ... View more

Hello,   I don't see any issues with those sessions, they look healthy with 2-way traffic.   In this situation I would take a packet capture either on the firewall, or on the server itself with tcpdump to analyse the traffic flow. Since it appears to be plaintext HTTP, the HTTP responses might be indicative of the issue (For example you might see 404 not found for some out of date repository URL).   Otherwise I'm not sure if there is a more verbose output available for apt-get to shed more light on why it failed.   Regards, - DM ... View more

Hello,   This is a sequence number for the log entry itself which the logging systems use to keep track of the logs. It's not used for anything actually related to the User-ID feature.   I'm not sure what the max value is, but I have a log with a sequence number of 7064826507313355923, so it can get pretty big...   Regards, - DM     ... View more

Hello,   This is quite a complex ask for a forum, but here's what I can tell you.   Firstly, when downgrading from 10.1 to 9.0, you are hitting 2 PAN-OS releases which are end of life and end of support. Those versions are 10.0 and 9.0. If something goes wrong when you reach either of those versions, it may be difficult for Support to help you, and you may simply be asked to factory reset and upgrade back to a supported release.   While I don't know your reasons for doing this, I can't recommend this course of action. If you must downgrade, I would advise getting to 9.1 and no lower.   So about the actual downgrades. 1) I believe you would need to downgrade step by step, 1 release at a time. 10.1 -> 10.0 -> 9.1 -> 9.0. 2) Usually when downgrading, you should select a config which was saved on the version you are downgrading to. It's unlikely your config can be used for the downgrades. If you don't or can't do this, you will very likely see autocommit failures and have to manually delete some things from the config on most downgrades. 3) There are a lot of things to consider when downgrading due to different functionality, especially if you've actually been using 10.1: Upgrade/Downgrade Considerations (paloaltonetworks.com) (10.1 -> 10.0) Upgrade/Downgrade Considerations (paloaltonetworks.com) (10.0 -> 9.1) Upgrade/Downgrade Considerations (paloaltonetworks.com) (9.1 -> 9.0)   Regards, - DM ... View more

Are the apps published based on users or user groups? If so, check if setting the user to 'all' helps.   I've seen a similar User-ID issue which I believe will be fixed in 10.2.3. ... View more

Hello,   @Josh_Morris wrote: but still reaches the same URL on port 443, it won't apply the URL category.  Usually port 443 is used for TLS applications, in which case it should be possible to use with a URL category. We use the SNI in the Client Hello and can also use the certificate CN to determine URL's if the traffic is not decrypted. If the traffic is not decrypted, you can only match custom URL's based on the actual domain and not the full URI path.   If it's completely a non web application, let's say RADIUS for example, then no you can't match with a custom category since it's just IP to IP traffic without a URL. In that case I don't see how an FQDN would allow more access than you want. It will allow access to a specific IP, and you can further lock down the rule through the use of applications and services.   - DM ... View more

Hello,   I believe you could use device checks as a config selection criteria which would match a certificate to a GP config. See 'Device Checks' > 'Certificate Profile' here: GlobalProtect Portals Agent Config Selection Criteria Tab (paloaltonetworks.com)   So you could have it like this for example:   Config 1: Group cn=no_cert matches this config No Device Check   Config 2: Group cn=cert_needed matches this config Device check cert profile   Users in group no_cert would match config 1 whether they have a cert or not. Users in group cert_needed would match config 2, but only if they have a cert. Users without a cert won't match this config, and if you have no other configs they can match, they can't connect due to no config found.   There is a caveat. Auth override cookies don't work with this config, which will be seen upon commit: Authentication Override and Config Seletcion Criteria -> Device Checks/Custom Checks are both configured, Authentication Override will be disabled.   You can then remove the cert profile from the authentication tab if pre-logon is not needed. If it's needed, you need to set the Allow Authentication with User Credentials OR Client Certificate  option to Yes (User Credentials OR Client Certificate Required). This is would allow the pre-logon user to auth with certificate, but the user can bypass it if they have valid credentials and cert will be checked using the config selection criteria mentioned above.   2nd possible option is to use no cert profile on the Portal, and then have 2 gateways configured - 1 with a cert profile and 1 without it. Use config selection criteria to direct users in certain groups to either gateway 1 which needs a cert, or 2 which doesn't.   - DM ... View more

Hello,   On this forum it would be difficult to determine the cause of the Portal connection failure, but I have seen this before when Zscalar was blocking a response. It could really be anything at this stage. (P17196-T12160)Debug(1182): 06/09/22 14:46:41:944 PostRequest error code=12152(The server returned an invalid or unrecognized response)   Internal Host Detection is setting which comes from the Portal. If the Portal is inaccessible, as it shows above, then the cached Portal config is used. If you set "Save Username Only" to "No", GlobalProtect will no longer be able to find a cached config, since the name of it includes a hash of the username and relies on saved username to pick it up. That's why you've started to see the issue after disabling it. (P17196-T12160)Debug(8554): 06/09/22 14:46:41:944 Skip retrieve cached portal configuration for empty user   I would recommend saving the username to ensure a cached config can be used in case of connectivity issues to the Portal. To cache the config, the user will still need to make one successful connection though.   For the WINHTTP error 12152, I would start with checking packet captures and seeing if you can rule out any 3rd party intrusive/security software by disabling them temporarily under test conditions.   - DM ... View more