About pkaren

Hi, I'm wondering if anyone happens to be doing successful inbound inspection of SMTP/TLS to a FortiMail appliance? Or any other mail server for that matter.  I've run in to a brick wall when it comes to renegotiation. The Palo is serving the correct certificate and a manual connections using openssl (openssl s_client -debug -connect mx1.XXXXX.com:25 -crlf -starttls smtp -showcerts) over a "decrypted" session and an "untouched" session shows identical output up until this point: Decrypted (or well, attempted decryption) on the left and undecrypted normal session on the right. I've made the decryption profile as generous as possible (i.e. not blocking any sessions and allowing all sorts keys and cryptos) and ECDHE-RSA-AES256-GCM-SHA384 is supported according to the docs. Anyone have any good ideas what to try next? It feels somewhat like https://live.paloaltonetworks.com/t5/general-topics/ssl-inbound-inspection/td-p/246059 but I have no idea how to configure ciphers on the FortiMail. ... View more

Does anyone if it is/should be possible to configure a PBF rule with src zone any? The inline help says "To choose source zones (default is any), click Add and select from the drop-down." but 'any' is not an option when I actually try to create the rule in Panorama and I'm forced to choose a zone to be able to save the rule.   ... View more

We have configured GlobalProtect for AlwaysOn using machine certificates for pre-logon. This works fine on both Mac and Windows. In the portal agent config we have also a gateway configured as Manual Only that the users can switch to for getting access to additional resources once they are logged on to their computer. This gateway uses MFA (Radius) authentication with username/otp. This works fine on Windows. Now to the problem: When switching to the 'Manual Only' gateway on Mac, the Username field is pre-populated with the 'username' (i.e. machine name) picked up from the certificate that is used for the pre-logon authentication and it's not possible to change it.   Does anyone know if this is a bug or a feature? I've tried various settings in the App Config without success, and as stated it's not locked on Windows clients.   PanOS 8.0.14, GP 4.1.7. ... View more

When using Nordic Edge it's possible to set a "Response Message" in the Radius server. This message is then displayed to Global Protect users logging in instead of the standard "Please enter password for gateway x.x.x.x". I assume this is done using a radius attribute, but the question is which? Is it one of the standard radius attributes or a custom one? Anybody knows? The reason I'm asking is that I'm trying to do this on another brand of radius server. ... View more