About PozsonyiAttila

Hi,    My question would be, is it possible to use template variables to set primary end secondary dns for DNS proxy rules in Panorama?   I can set a static entrys' IP address value to a variable defined in the template, but can't find the way to do the same for proxy rules.   Context: Our branch offices each have their on subnet, doman controllers and Palo Alto FWs. Subnets and IP addresses are standarized, Office 1 DC1 has IP of 192.168.1.1, Office2 DC1 has 192.168.2.1, etc. The DCs have their own template variable, let's say $DC01   The clients use the firewalls DNS proxy for DNS queries, however I want some queries for specific domains to be forwarded to the local DC, instead of the primary DNS server of the DNS proxy.   Of course I can override the configuration of the DNS Proxy object on the local firewall, but I would like to avoid that, it would make the template variables and the whole central management concept unusable.   Thanks in advance   Regards ... View more

Hi everyone,    I bumped into a rather annoying issue with Global Protect.   Context:   We needed and external authentication source for MFA with our Global Protect deployment, so we set up OKTA SSO (with SAML) for our Global Protect Portal. In order to Group mapping to work with the external Okta directory, we needed to set up an LDAP profile, configure user mapping and configure the Okta Global Protect app to send username in the DOMAIN\username format. (we need group mapping to work for config selection and Clientless VPN apps). It works as expected, on Portal login, the users are redirected to Okta for sign in, and on successful auth, the user is logged in to the Portal.   And here's my issue. For External Gateway we need another authentication source (in this case an internal LDAP profile) AND client cert authentication. The authentication fails on the external gateway with the error "Username in client cert is different from the input".   That is because, the client cert CN = username, but the portal forwards the username to the external gateway in myorg-okta.com/username format.   As a workaround I tried to set the Certificate profiles' (linked to the External Gateway Auth Tab) Username field from "Subject" to none. Result was the External GW auth window popped up, the username field was auto filled with myorg.okta.com\username prompting for password.   Now if I delete the DOMAIN part of username input, the client can successfuly authenticate against the internal LDAP profile. Problem is, the users would need to manually delete the DOMAIN part of the username each time they log on.   I tried the authentication modifiers in the internal auth profile but it didn't work out. Because the internal LDAP profile points to Active Directory, the %USERDOMAIN%\%USERINPUT% format doesn't work, as AD does not support DOMAIN\username format with the sAMAccountName attribute. When I try 'None' with authentication modifiers it strips the DOMAIN name part of the username as expected, but because of that I run into "Matching client config not found" issue, and that's because the Agent configuration is linked to user groups existing in the internal AD.   Maybe I'm missing something obvious, but my question is, is there a way to prevent the Global Protect Portal to forward the username (used to log in to the Portal) to the external gateway automatically? Or in another way, can I "present" a completley blank authentication form for users trying to log in to the External Gateway?   Kind regards,    Attila           ... View more