About Remo

The block rule is a userbased rule, is the connection maybe from a user not specified in this deny-rule? ... View more

Hi @bit_byte  Is the assumption correct, that both firewalls are paloalto firewalls? Anyway, when you say "Firewall A: Only client hello message we got means server hello message drop by firewall A", does this really mean the server hello is dropped by firewall A or isn't there any server hello on firewall A which would mean that the server hello is dropped by firewall B. ... View more

Ok, I actually does not matter who owns the laptop. It matters if these laptops are centrally managed for example with active directory. As you are asking this question I assume you have split tunneling configured and only traffic towards your internal network is sent through the vpn tunnel. In this case you would need to block the outgoing ssh connections towards the internet locally on these laptops. If you route everyrhing (0.0.0.0/0) into the tunnel, then simply create a rule on the firewall, but I thought this would be too easy for a question here 😉 ... View more

Hi @Ivy_Vo  Are these computers managed by your company or are these devices owned by the users? ... View more

Hi @Eilbron  Ok, got it and unfortunately you are right about this limitation. The only thing I can think of is that you install another SAML IdP in the role of some sort of "router". So the users enter their email/upn on that IdP and are then forwarded based on the domainsuffix to their actual SAML IdP. This way you could use one portal and based on the user that logs in the portal is able to assign the right config. But unfortunately it could be possible that you then hit another limitation but I am not sure about that - maybe the limitation of 32 also applies to globalprotect gateways. Anyway this probably you can also solve with different VRs/policy based forwarding rules. ... View more

Hi @Eilbron  What are you trying to do exactly? Different IP-Ranges for different user/device combinations? ... View more

Hi @vishal1379  the default captive portal currently does not have such a feature like a logout button. If you need something like that, probably the only way is to implement something outside the firewall on a webserver. But what the feature "Captive Portal Session Cookie timeout" could be something you are looking for. When setting this timeout low enough the user will be logged out when he/she does no longer browse the internet - if if the browser will be closed. https://live.paloaltonetworks.com/t5/best-practice-assessment-device/user-id-captive-portal-session-cookie-timeout/ta-p/338149 ... View more

Hi @Jafar_Hussain  How did you check the connectivity between the mgmt interface and the internet? Is the connection traversing another firewall where may be tls decryption is enabled? Did this suddenly stop working or was it never working? Do you have a dns server configured? If there is another firewall or even the same make sure the traffic is allowed and either tls decryption disabled or then the checkbox at "check update server identity". ... View more

Hmn ... strange ... (I want to have TLS1.3 on my IIS too but something obviously I am doing wrong 😛 )   Anyway, back to the actual issue: Did you try to do a packet capture of the full connection? Traffic between the client and the firewall and also between the firewall and the iis? In this capture you should see the TLS handshake packets including the ciphersuite proposal Did you do a packet capture when you connect from a client either directly to the reverse proxy or then with the unsupported protocol/algorithm checkbox disabled? Compare the TLS handshakes in the packet captures if there are differences If not done already maybe you should consider doing these captures and maybe post the results here. ... View more

What software do you use exactly for the reverse proxy part? ... View more

I assume you did reboot the system after the TLS1.3 deactivation? Btw. did you install an insider preview build? I was only able to find information about TLS1.3 activation in such preview builds... ... View more

Hi @shiv.bhagat  For a confirmation about which bug you are facing you should generate a tech suppport file and create a TAC case. We as "normal" users do not have the detailed informations about the bug, so only TAC is able to confirm if your situation is because of a specific bug. ... View more

Hi @shiv.bhagat  You should update to PAN-OS 9.0.9-h1 as this is currently the preferred release by PaloAlto (https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-p/258304). The fix for your issue probably already is included in PAN-OS 9.0.4 as this could be Bug PAN-112988 (Release notes of PAN-OS 9.0.4 you can finde here: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-release-notes/pan-os-9-0-addressed-issues/pan-os-9-0-4-addressed-issues.html) ... View more

Hi @shiv.bhagat  Please add some more information to your topic: What PAN-OS Version do you have installed? What hardware/vm model do you have here? Did you recently upgrade PAN-OS? Did you already try to reboot and if yes, does the problem then reoccur? (Is there a problem in your network that leads to a split brain and then the process is being killed or is it the other way?) ... View more