About MichaelMedwid

MichaelMedwid · ‎10-26-2022

Hi. We've had a lot of progress since then. One issue was upgrading to a more recent GP client. 5.2.12 has been less problematic and worked past a known bug. I'm posting the login event phases you should see in sequence as I was not clear on that part in February. Not that the get-config is when the address is assigned. Also are you pulling down the GP client debugs? They have a lot of into including ipconfig /all, netstat -rn, GP events. I wish there was a way we could get that data without bothering the user about it. But if you can get them to send it it's pretty insightful.

MichaelMedwid · ‎10-19-2022

I have users at a development partner company who need to access a dev SQL instance. So they need TCP 1433 to one server. I would like to restrict access to their corporate public NAT IP and require that they use AD credentials. But it would be preferable if they didn't have to install the GP client. Would it be possible to set this up on a PAN 3220? Thank you.

MichaelMedwid · ‎08-11-2022

I ran a packet capture on PAN to try and figure out an intermittent problem with one of my GP 5.2.5.66 users (Windows, Surface Pro) where certain web based or internal applications will just start working. The external are Outlook O365, Teams for example. If he disables GP then everything starts working again. We verified he's connected to VPN during these periods of failure and narrowed to a DNS problem. When I ran a pcap on the PAN, I could see that his system was first sending a query for the expected domain with the host - say scooper-p01.acme.com. But then the next packet would be trying to resolve scooper.hdcl.fl.comcast.net. So while his system was clearly connected to GP VPN (I couldn't have grabbed the packets otherwise), the presumed suffix was changing one DNS lookup to another. Has anyone seen anything like this? Any recommended fix?

MichaelMedwid · ‎06-30-2022

I have log forwarding policy which is referencing log type "url" twice. The first says send all URL filtering logs to a collection server. That works fine. Then the second one is a subset which says send any malware or phishing URL filtering logs to an email distribution list. Then I published. I can see someone his a phishing link but no email ever arrived. (Also on that note is there a way to check if the PAN tried to send an email?) The log forwarding policy is apply to a rule that permit traffic from inside to outside. Most traffic is hitting this policy in this direction.

MichaelMedwid · ‎06-30-2022

In Log Forwarding Profile I have URL Filtering/All Logs going to a log collection server. But for URLs of a phishing category I want those to be emailed. I tried to do this by creating a second profile match list profile URL Filtering/phishing. But it doesn't seem to be working. Any advice on how to have some go to email while most go to log server? NGFW

MichaelMedwid · ‎12-09-2021

Is there a means of copying all configuration from a 3220 PAN to a 3250 including the certificates? The main impetus to upgrade would be to accommodate more Global Protect tunnels (2048 instead of 1024.) I'm trying to understand what that migration might look like. TY

MichaelMedwid · ‎12-09-2021

So you're saying that if the 1025th GP session hit the PAN it would likely work as well as the 1024th? (Individuals are using financial applications which use very little bandwidth.)

MichaelMedwid · ‎11-29-2021

Each individual 3220 is licensed for 1024 GP sessions I believe. So if you have a pair in active-active HA does that mean you could have 2048 sessions?

MichaelMedwid · ‎11-15-2021

How can you view the peak number of global protect licenses are being consumed on a PAN? And when those licenses are consumed, what is the behavior of the GP clients that connect beyond the limit? For example the 3220 allows for 1024 GP connections simultaneously from what I understand. What happens to the 1025th GP client that attempts to connect? TY

MichaelMedwid · ‎11-09-2021

Oh - I found it. If I hover over the Expand button it says "Expand and show more data". And sure enough - it did just that. 🙂

MichaelMedwid · ‎11-09-2021

Hmm - in the global filter on the left I see the option to choose say source address and a value. But there's no operator available like notin. I tried restricting filter to only include source zone. But that still left me with the "others". If there's some other way to get this info - custom reports or other - that would be just as good.

MichaelMedwid · ‎11-09-2021

For the screen cap below I filtered the destination IP to one particular server. This Source IP Network Activity widget is showing me the first 10 IPs that talked to it. But then all the other sessions are summarized as "others". I want to know all the IPs and to then export that information. Clicking on "others" doesn't seem to do the trick. If I click the down arrow at the right side of others I get four ghosted options. What's the mojo?

MichaelMedwid · ‎11-02-2021

In logging I can see that SAML authentication via Azure is succeeding. However my GP client is failing to successfully connect I believe for some deficiency in the certificate. I have a self signed certificate in a cert profile at the portal and gateway for this GP On Demand setup. Authentication is set to require certificate *and* user ID/password. (Soon this will be MFA. But first things first.) Can a self signed certificate serve the need in this case? What properties would need to be in such a self signed certificate to get GP connect? Thank you.

MichaelMedwid · ‎10-20-2021

I have some GP users who like to complain about their GP connection but with whom are difficult to book troubleshooting time. Could there be any way to remotely collect details of their GP session without having to tell them how to initiate a log capture or remoting into their machine? Perhaps something could be pushed to their laptop via Azure Autopilot? Any thought appreciated.

MichaelMedwid · ‎10-06-2021

I am just asking about go/no-go. If you belong to AD group say GPVPN-USERS then you get access. And if not you're out of luck. But that's a good idea as to limiting resources which can be reached based on one's group membership. If you have a resource on that I'm interested too.

Member Since	‎02-05-2020 01:35 PM
Date Last Visited	‎07-05-2023 07:17 PM
Posts	59
Total Likes Received	4

Online Status	Offline
Date Last Visited	‎07-05-2023 07:17 PM

About MichaelMedwid

Can PAN gateway client config use both IP based split tunneling and use domain name exceptions?

Re: Is it possible to monitor average/min/max latency to Global Protect clients connected to a PAN 3220 or VM PAN?

Re: PA-300 induced high latency for GP clients with just 200Mbps troubput

Is it possible to monitor average/min/max latency to Global Protect clients connected to a PAN 3220 or VM PAN?

Re: Can you configure multiple prisma access tunnel end points?

Does Prisma Print work for Sharp and Ricoh printers/scanners?

Re: PA-300 induced high latency for GP clients with just 200Mbps troubput

Is it possible to specify a source address for certain destinations when using Prisma Access?

Can you configure multiple prisma access tunnel end points?

PA-300 induced high latency for GP clients with just 200Mbps troubput

Re: Is it possible to monitor average/min/max latency to Global Protect clients connected to a PAN 3220 or VM PAN?

Re: How do you see what cipher suites are enabled for Global Protect?

Global Protect license usage and behavior on running out

Re: Using corporate wildcard certificate for Global Protect

Re: PA-300 induced high latency for GP clients with just 200Mbps troubput

Re: Is it possible to monitor average/min/max latency to Global Protect clients connected to a PAN 3220 or VM PAN?

Re: PA-300 induced high latency for GP clients with just 200Mbps troubput

Re: Is it possible to specify a source address for certain destinations when using Prisma Access?

Re: Can you configure multiple prisma access tunnel end points?

Re: Global Protect gateway is unresponsive

Clientless VPN for SQL Traffic?

Comcast domain suffix getting appended into DNS requests over Global Protect

Re: Log Forwarding - multiple instances of same catgory?

Log Forwarding - multiple instances of same catgory?

Upgrading from 3220 to 3250

Re: GP Licensing with Active-Active 3320 Pair

GP Licensing with Active-Active 3320 Pair

Global Protect license usage and behavior on running out

Re: How to view the "others" in ACC Network Activity Source IP Activity

Re: How to view the "others" in ACC Network Activity Source IP Activity

How to view the "others" in ACC Network Activity Source IP Activity

Global Protect - valid certificate when using Azure SAML authentication

Remote initiation of Global Protect Logs

Re: Limiting GP Access to a domain group

Unlock your full community experience!

About MichaelMedwid