About djrodb

I have successfully deployed GP and run logging scripts automatically post login. There is few issues though.... 1st issue - We ran into a major bug in PAN OS 5.0 - 5.2 that resulted in internet connection drop outs. We had to revert back to 4.1.8. GP was not the cause of the bugs. 2nd issue - We've not upgraded to PAN OS 5.x yet - waiting until 5.0.8 or later.... You need to make sure you install the correct certificate and the certificate is located in both stores on the local pc. You need to make sure you GP configuration is correct, As I don't have PAN OS 5 I can't post pictures -  however if you can, I can advise what is correct or missing You can check the VPN connection details view (Under VPN settings where you can view VPN session info) You boot your laptop and watch for the certificate authenticating on this view - before you press ctrl al del - this will tell you if your certificate configuration is good. If you authenticate pre logon then the problem is with GP VPN configuiraiton on PAN device. You need to make sure the certificate for pre-logon has pre-logon as its ID if the client certificate is not name pre-login then you will have trouble... That's all for now  - the trick is to get certificate authentication before you press crtl alt del - you can check in the VPN session view in GP VPN configuration - if you certificate authenticates then running the login script will follow automatically when you log in. It does work, I know it does. Hope this helps Rod ... View more

Do you really need to use a proxy at all? Just allow your clients direct access to the internet via the PA - simple. I assume everything will be PAT'd out via your firewall? This allows you to use the full features of the PA web monitoring function.. Rod ... View more

I've had big problems setting this up. I can't seem to direct any incoming requests to the CP authentication system (tried both radius and local). I ended up going with an Citrix solution via F5 to farm out access to the internal resource. If you get it working I would be interested to see your configuration. Rod ... View more

John Thanks for your help so far. I'm strugling with the concept of CP redirect and how the following statement translates to a working example. Make sure the host name or IP address you specify for the "Redirect Host" is accessible to the public. If you use a host name make sure it has a resolvable public DNS record Does this imply that the redirect host has to be an internal web server? or does it mean an interface on the firwewall - say for example the main firewall inside (trust) L3 interface? If it's an internal web server do I need to go through the normal procedure of creating a static nat from the out side to the inside server IP for the captive portal bit? I've added my current config to see if you or anyone else can clear this up? thanks. ... View more

John, Thanks. That cleared things up. I still can't get the system to present the redirected authentication login page. The documentation for Captive Portal hasn't been updated to PANOS 5 yet. Rod ... View more

Thanks for the confirmation Klaus. Rod ... View more

I've resolved my problem. Please refer to https://live.paloaltonetworks.com/message/21662#21662 ... View more

Hi Albert. I've finally got this working. The problem was me settings in the GP portal config. I originally selected the LDAP group I'd configured under the user/user group setting in the GP portal client config. I changed this to any and it resolved the problem. This feature works really good. Thanks for you help. ... View more

Hi, I'm hitting the same issue. Can you or anyone clear up pre-logon definition? for example do I need to create a user called pre-logon on the PA and create a security rule matching the GP VPN or do I create a pre-logon user in AD? or do I not need to create a pre-logon user ID? I've got pre-logon partly working. The pre-logon feature fails with the error' user domain\pre-logon  failed authentication' invalid username/password' However when I log into the laptop with my AD credentials the GP client authenticates. Rod ... View more