About Remo

Remo · ‎06-18-2018

Is the problematic user in the same OU as the other three? Or more specific: is the user in an OU that is covered by the base DN that you specified in the LDAP server profile?

Remo · ‎06-18-2018

@OtakarKlier For something like this there is also the way to configure authentication cookies. So you could configure the same RADIUS profile on the gateway without degrading the security with an authentication profile without OTP on the gateway.

Remo · ‎06-18-2018

@LukeBullimore wrote: Hi, a) There are two ways you could do this, limit the OS in the portal agent configs section @SThatipelly This probably is the easiest/best way. Here you could specify a usergroup, so only users of that usergroup receive the configuration for Android/iOS devices. Other users will be able to login to the portal actually but cannot connect as they will not receive the required configuration. But if you already have an MDM, you don't really need the Gateway license. With the MDM for example you could deploy a client certificate to the specific devices and so only these devices will be able to connect. This does not require the gateway license as you would use the integrated VPN clients on the mobile devices.

Remo · ‎06-17-2018

@_slv_ Yes, the pre-logon feature can be used for password changes or setting a new password when the user is required to. But if you use also the single sign ln feature you have to choose the Global Protect login option and if this option is chosen, passeord reset/change no longet work so the user has to change back to the default login option to change the password and after that he has to change again to the global protect login option to make single sign on work again... ... this works for IT people, but not for "normal" users who would then call the hotline every time ... so this feature sounds good with the password change in the GP application, but I did not test it so far.

Remo · ‎06-17-2018

@junior_r This sounds more like an issue on your RSA RADIUS server as it depends on the configuration on that server how the authentication flow should look like. From my own experiences I know two types of authentication flows User enters username and in the password field his OTP and also the password. This way the RADIUS server is able to check all login factors at once and returns access-accept or access-reject User enters username and password and klicks login. Then the RADIUS server checks these credentials and if correct it sends a RADIUS access-challenge packet to the firewall which then displays a new inputfield for the OTP.

Remo · ‎06-17-2018

@hbshin It could be exactly the same behaviour as described in the article you mentionned as the applications in your screenshot are also analysed with a decoder. When you enable the start log or even better with a flow basic analysis you probably find out more about this. But besides this behaviour with allow logs for a deny rule. From your screenshot it looks like your trust zone has private IP addresses (RFC1918), so may I ask you why you have a rule allowing ping, icmp and traceroute from the internet towards your internal network? And: do you still have these "allowed"-deny-logs when you set the service in rule 34 to application-default?

Remo · ‎06-17-2018

@BPry I abolutely agree with your post. You know this, I know this and hopefully most of admins who have to administer with firewalls (as this recommendation to avoid using new major releases applies to almost all firewall vendors)... ... but for all that are not aware PAN could make it more obvious, as the marketing and all other available information about 8.1 never clearly mentions "Do not install this in production environments" and almost as important is the fact that using new hardware, which ships only with the new release, could be frustrating (because of bugs, bugs and even more bugs)

Remo · ‎06-17-2018

Master Key and HA IPs must be configured locally on the firewalls Edit: I am somehow not able to post a link ... so simply google for "panorama template capabilities and exceptions 8.0" and the first link will show you the adminguide with the exceptions that cannot be configured in a template

Remo · ‎06-16-2018

With the API I would use the export which you already mentionned or this one for the panorama config: https://PANORAMA/api/?type=op&cmd=<show><config><running><%2Frunning><%2Fconfig><%2Fshow> And the running config of the firewalls with the same save command but add this to the url to get the firewall running config: &target=<device-serial-number>

Remo · ‎06-16-2018

Hi @sprabhu Does it need to be done by an API call? If not, probably the best way is the scheduled config export (https://www.paloaltonetworks.com/documentation/80/pan-os/web-interface-help/panorama-web-interface/panorama-scheduled-config-export ). This way panorama daily saves the panorama configuration and all the configurations of the managed firewalls to an SCP or FTP server.

Remo · ‎06-15-2018

Hi @junior_r What I can say about that: Works great with Google Authenticator (or any other TOTP App) And yes, you need a RADIUS server for that. What did you use in the past? And where are the users stored that you want to authenticate (Active directory, SQL Database, ...) A great one is Censornet MFA. Other alternatives which are free (if you don't want/need support) are LinOTP or FreeRADIUS with a Google Authenticator PAM plugin.

Remo · ‎06-15-2018

... finally 😉

Remo · ‎06-15-2018

Hi @hbshin @hbshin wrote: 1. How can Paloalto Firewall identify UDP Applications (ex : sip, ntp, sip, dns, snmp, tftp..) with one packet from source received ? PaloAlto identifies these applications based on the headers in the datapackets. Because UDP is stateless (not something like TCP handshake) in most cases there already enough informations in the first packet for App-ID. @hbshin wrote: 2. when i configure service any What is difference policy action deny & drop? Each application has a default deny-action specified which is taken when you set the action to deny (some apps have reset-client, some have reset-both, ...). If you set rhe action to drop, then this default deny-action will be ignored and the connection will be silently dropped.

Remo · ‎06-14-2018

@hfregoso wrote: Panorama would be na easy way of doing it but the only thing that will not match are ithe interfaces. Make sure you make the proper adjustments to the exisiten zones, interfaces, and routes. After doing this all should be smooth. Try to use the same OS. If you use the same interfaces you don't have to adjust anything in order to commit the configuration from panorama to the firewalls and if you haven't configured any "new" features the devices don't even need to have the same major versions installed - but in general, the recommended way is to install the same versions.

Remo · ‎06-13-2018

@rperez-mz Making them "public" seems to be the solution. But what do you see in your webbrowser when you access the file? You probably see a bitbucket website with the txt file somewhere embedded in that website, right? If yes, is there somewhere the possibility that shows you ONLY this txt file without anything html related around that txt file?

Member Since	‎03-20-2013 04:23 AM
Date Last Visited	‎11-26-2025 01:29 PM
Posts	2,247
Total Likes Received	806

Online Status	Offline
Date Last Visited	‎11-26-2025 01:29 PM

About Remo

Re: Certificate Expired Warning in Deploy but all certificates are good

Re: How to request a URL filtering change to High-Risk?

Re: Template vs Device Group

Re: sorting question

Re: Panorama Disk

Re: Cortex XDR on Citrix non-persistent multi-user server

Re: Bad support from plaoalto

Re: Activate Firewall with Expired License / Unknown Auth Code

Re: Wait time

Re: Cortex XDR on Citrix non-persistent multi-user server

Re: Active-Passive pair takes long to show the status when one is rebooted.

Re: sorting question

Re: Deal Registration End Customer Details not Include

Re: Enable Qos on sub-interface

Firewallcrash because of Application cloud Engine (ACE)

Re: Admin console unreachable/cant remote in or ping - PA support wont let you submit a ticket without a TSF file - which you get via admin console

Re: How to request a URL filtering change to High-Risk?

Re: Log Container Page Only - impact?

Re: Stop wsc files

Re: Customer Support Portal error

Nominated Discussion - Sorting Question

Nominated Discussion: URL Filtering in TLS v1.3

How to Add Log Forwarding Profiles in All Security Policies

Re: LDAP groups not populating correctly

Re: How can I get user to type username, password and OTP when using RSA Radius 8,1 on Global Protec

Re: How to limit global protect for specific android/ios users?

Re: Anyone use "Expired Active Directory Password Change for Remote Users" in PAN version

Re: How can I get user to type username, password and OTP when using RSA Radius 8,1 on Global Protec

Re: UDP log that hit any deny rule and show allow

Re: After upgrading to 8.1.1 VPN always on pre-logon->user-logon failings

Re: Master key and HA 1 ip address

Re: Officially supported method for Panorama backup through API

Re: Officially supported method for Panorama backup through API

Re: Has anyone used google authenticator with Global Protect?

Re: PAN-OS 8.1.2 introduces new log options

Re: I have two questions. about UDP Application & policy action

Re: Installing config on a different model.

Re: PAN EDLs and Bitbucket

Seattle Beta - GlobalProtect (ELK)

Unlock your full community experience!

About Remo