About Remo

So a short recap: @Alex_Samad Global protect infrastructure with one portal, 2 external gateways and one internal --> is this a fully distributed setup? Do you use authentication cookies? You have 6 absolutely identical clients but only 4 of them are able to connect --> do all of them connect to the same external gateway? It was all working until day x where 2 clients started having problems with the connection   In addition to this discussion you probably also want to open a TAC case... ... View more

Hi Robert   This can be done with a basic firewallrule. Simply add source zone/address and destination zone/address and then ftp as application with application-default as service and your done. (FTP over HTTP on a TMG is, if my short google search was correct, nothing else than a normal FTP connection opened in Internet Explorer or another browser)   Regards, Remo ... View more

So far there is no end of sale announcement for the pa5000 series. Quote from the end of life policy: For hardware platforms, the following End-of-Life policy applies Palo Alto Networks will provide 6 months notice prior to a product's end of sale, at which time the product will no longer be available for order. Palo Alto Networks will provide technical assistance for a period of 5 years following the End-of-Sale date, provided a valid service contract is maintained on the product. Software will continue to be supported per the below software policy. In addition, the last feature release available on the hardware platform in EOL will continue to be supported for the duration of the hardware EOL support. Software support may include technical support, bug fixes, maintenance releases, workarounds, and patches for critical bugs. Hardware replacement or replacement parts will be available for 5 years following the End-of-Sale date, provided a valid service contract is maintained on the product. At Palo Alto Networks discretion, hardware may be replaced with similar or equivalent product. A product must be covered on a support contract as of the End-of-Sale date to be eligible for renewal. Support contracts may be renewed for the duration of the End-of-Life cycle, but cannot lapse during this time and be reinstated later.   https://www.paloaltonetworks.com/services/support/end-of-life-announcements/end-of-life-policy   ... View more

Of course ... would have been too easy, if that was the solution 😛   At the times of these failing connections: is there something useful or at least regarding that client in the system log of your portal and/or gateway (s)? ... View more

Hi @Alex_Samad   Is your pa3-vpn-gateway somehow private/hidden so that only you (maybe with a local host entry) can connect? The reason I am asking is because from my point of view, with the knowledge I have from your posts so far, there is a problem on pa3-vpn-gateway. I am able to resolve your gateway 1, 2 and the portal by DNS but not gateway 3. In addition, a TLS check shows the correct information for gateway 1, 2 and the portal and all 3 certs show the earlier mentionned self signes root cert. But on gateway 3 or better on the IP where I assume gateway 3 should be, the TLS check fails completely.   In an earlier post you wrote that other clients are working: what rules do you have in plave to decide which gateway will be chosen by the clients? All with the same priority or based on usergroups ... So rhe working clients, do they also try to connect to gateway 3? ... View more

@Udineverisch The same for you: the root cert of your portal/gateway cert is in the local trust store of your computer? ... View more

@Alex_Samad Are you sure your self signed root cert is installed on this client? (T17360) 08/02/17 10:44:28:403 Error(1128): Failed to X509_LOOKUP_load_file (T17360) 08/02/17 10:44:28:403 Debug( 296): Open_SSL_connection: subject '/C=AU/O=somecompany Pty Limited/OU=PA/CN=pa3-vpn-gateway.somecompany.com' (T17360) 08/02/17 10:44:28:403 Debug( 300): Open_SSL_connection: issuer '/C=AU/O=somecompany Pty Limited/OU=PA/CN=vdcPAGlobalProtectCA' (T17360) 08/02/17 10:44:28:403 Info (5144): Root ca does not exist. (T17360) 08/02/17 10:44:28:403 Debug( 731): StandardizeIpv6Format host=pa3-vpn-gateway.somecompany.com (T17360) 08/02/17 10:44:28:403 Debug( 793): standardized name is pa3-vpn-gateway.somecompany.com (T17360) 08/02/17 10:44:28:403 Debug( 731): StandardizeIpv6Format host=pa3-vpn-gateway.somecompany.com (T17360) 08/02/17 10:44:28:403 Debug( 821): standardized common name is pa3-vpn-gateway.somecompany.com (T17360) 08/02/17 10:44:28:403 Debug( 942): Check domain name pa3-vpn-gateway.somecompany.com versus CN anme pa3-vpn-gateway.somecompany.com (T17360) 08/02/17 10:44:28:403 Debug( 905): Cert pa3-vpn-gateway.somecompany.com name check succeeded (T17360) 08/02/17 10:44:28:403 Debug(5157): Failed to verify gateway pa3-vpn-gateway.somecompany.com's server certificate using trusted root CA of portal configuration. (T17360) 08/02/17 10:44:28:403 Debug(5162): disconnect ssl. Did you add this root cert also to the trusted root certs in the portal configuration? ... View more

Hi @myasin   There is no 'right' configuration in your situation. It depends on some more details: Is the c2s vpn for internal or external employees? Will the users use their private computers or corpotate ones? If company computers will be used: are these devices completely under your  or your companys control (updates, antivirus, group policies - if AD integrated, ...)? How much do you trust these devices which connect by vpn? Do you have internet access for internal clients on the same firewall? What do you use for vpn login: AD users or local firewallusers or may be users stored on a radius server? Do you intend to use full or split tunneling? In most cases it is the best way to use a separate zone for the tunnel interface... User-ID also works with local firewallusers. You can simply enter the usernames into the security policy to restrict access to specific users and/or groups. But if you use AD users there are some more steps needed to get there (-->links posted by @TranceforLife).   Regards, Remo ... View more

A more modern method for the single sign on instead of NTLM would be SAML (https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/authentication/configure-saml-authentication#_85451) May be you already use Microsoft ADFS for some services so you could easily configure rhe captive portal also to use SAML.   For the problem with the admin users I recommend, as mentionned by @reaper, to use the exclusion user list. There you can also use wildcards, so you don't have to enter every adminuser individually ... View more

@raji_toor Did you read my post? This is the solution for your problem... ... View more

The solution (/workaround) wasn't the only solution ... if you comoletely manage the firewalls from panorama, you could disable the config sync completely and you then will be able to configure the local accounts independently on each firewall because panorama makes sure that the config on both nodes is in sync (as long as you properly configured templates and device groups) If you expose the WebAPI or the CLI on a dataplane interface only for your account-management-server you could also treat every cluster as one device. Similar to the proposed solution of @BPry, but not exactly the same ... View more