About Ben-Price

Ben-Price · ‎01-26-2022

Hi @nikoo, I have just run into the same issue when going along the upgrade path to 10.1.3, when we hit 9.1.12, GP VPN and IPsec VPN both broke. Turned off 'strict-IP-check' on the internet zone protection profile and both VPNs are working again. Haven't re-tested on 10.1.3 as yet. Only thing I noticed was our local VPN IP address is on a loopback address in the internet zone, the below KB article seems to suggest that 'strict-IP-check' can cause an issue with loopback addresses, in saying that not sure why it only just became a problem with 9.1.12. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g0000008U3FCAU Did you end up raising this with PA support? or find a solution here?

Ben-Price · ‎01-24-2022

@BPry Can you confirm?

Ben-Price · ‎01-23-2022

Hi All, I see that support for PAN OS 8.1 will end on March 1st 2022 for some Palo Alto platforms. On other Palo Alto platforms, PA-200, PA-500, PA-5000 series and M-100, support for PAN OS 8.1 will continue until their respective hardware EOL dates e.g., 23 October 2023 for the PA-500. I just wanted to double check, that all aspects of PAN OS 8.1 will be supported on these platforms until their respective hardware EOL date e.g., if a vulnerability is found in PAN OS 8.1.21 on a PA-500 this will be patched in a new version of PAN OS 8.1.x, bug fixes will be resolved, dynamic updates pushed etc.? Referencing the below docs here: https://www.paloaltonetworks.com/services/support/end-of-life-announcements/hardware-end-of-life-dates.html https://www.paloaltonetworks.com/services/support/end-of-life-announcements/end-of-life-summary Thanks in advance.

Ben-Price · ‎01-22-2022

@davisjj Thanks for your response. Its strange, this was working for these iOS devices until we renewed our forward trust certificate as the old one was going to expire, Now with the new renewed certificate the iOS clients don't work. No version iOS config or version change.

Ben-Price · ‎01-20-2022

@BPry Yes, the required root CA is trusted on the iOS devices. It is the same Root CA that issued the last SubCA cert. Tried installing the SubCA cert on the iOS device and trusting that but still the same issue.

Ben-Price · ‎01-20-2022

@davisjj @george.v.bowles @RocRaider Did you guys ever find an resolution to this issue? Experiencing the same issue on IOS 14 and 15. Windows devices working fine.

Ben-Price · ‎01-20-2022

Hi All, The Forward Trust certificate on a PA-820 firewall pair was expiring, so we issued a new SubCA certificate from the Windows ADCS root CA server and updated it on the firewall. The certificate was imported with a 2048bit key and there is a password on the key. Since switching over to the new certificate for forward trust (SSL Decryption), IOS devices are no longer able to browse to the internet when an SSL Decryption policy is applied, where Windows devices are able to without issue. The IOS devices show an error “This connection is not private”. I have verified the certificate trust chain is valid and correct on other devices, and I have verified that the root CA is trusted on the IOS devices. Switching back to the old certificate fixes the issue, however this certificate has now expired. I have also tried re-issuing the SubCA certificate several times with various changes without any success. The Decryption profile supports tls 1.0 -1.2, however I also tried enabling 1.3 and this made no difference. (this has been reverted now). In the decryption log on the firewall I see the following errors “Received fatal alert CertificateUnknown from client. CA Issuer URL…>” I have tried Chrome and Safari. I have tried IOS 14 and 15 (latest). All websites are affected Used the same certificate template as the previous SubCA cert Restarted management server Does anyone have any idea what may be causing this issue and what steps we can take to diagnose and resolve the issue?

Ben-Price · ‎01-18-2022

Hi All, I was just wondering if running the below command will have any impact on a production environment or is it merely resetting the cache status and shouldn't have issues to run in production? >debug dataplane reset ssl-decrypt certificate-status Thanks.

Ben-Price · ‎01-09-2022

@BPry Firewall did not receive the signed URL key required back from PAN servers to upload telemetry data (based on the telemetry logs), which looks to have caused the error. Also, the firewall failed to fetch the device certificate correctly upon 3 month renewal. Rebooted firewall and waited 24 hours and the firewall was then able to retrieve the certificate and telemetry data began to flow successfully again. Looked to have been an issue with the Palo Alto back end as no changes were made on the firewall except a reboot, but am not quite sure.

Ben-Price · ‎01-03-2022

@southardd Did you ever get a resolution for this issue?

Ben-Price · ‎01-03-2022

Hi All, We have a client who all of a sudden started to receive the following telemetry error - 'CDL Receiver Key Empty' on PA-440. No changes have been made. Currently running PAN OS 10.1.2. They are not using CDL and are just sending Telemetry data to PA with a certificate. This looks like it may be a an issue on the PA backend. Can anyone clarify? @BPry ? Thanks in advance.

Ben-Price · ‎12-08-2021

Hi All, Can anyone answer a few questions about Cortex XDR Broker VM? If the Broker VM is being used as a proxy, do the hosts connecting to the Broker VM need to be on the same subnet as the Broker VM or can they communicate with the Broker VM via the default gateway of their VLAN? When defining the proxy server on Broker VM, is the address you assign here the IP address of the Broker VM itself? Can someone explain the Internal network of the broker VM? Is this the subnet that the container applets use internally on the VM itself or is this something else?

Ben-Price · ‎12-07-2021

@BPry Thanks for the feedback. They have tested with a user in a group and a user directly assigned to the app. I have asked them to check Microsoft.

Ben-Price · ‎12-07-2021

@BPry @reaper Any ideas here?

Ben-Price · ‎12-07-2021

Message from the authd.log 2021-11-30 13:19:35.231 +1100 debug: _log_saml_respone(pan_auth_server.c:348): Sent PAN_AUTH_FAILURE SAML response:(authd_id: 6998778942614154583) (SAML err code "2" means SSO failed) (return username 'Test.User@company.com') (auth profile 'Azure-AD-SAML') (reply msg 'SAML single-sign-on failed') (NameID 'Test.User@company.com') (SessionIndex '_a4abc986-aa3c-4717-923c-39a4e7717d00') (Single Logout enabled? 'No')

Member Since	‎05-16-2021 06:01 PM
Date Last Visited	‎04-28-2022 09:28 PM
Posts	113
Total Likes Received	33

Online Status	Offline
Date Last Visited	‎04-28-2022 09:28 PM

About Ben-Price

Re: UI issues in PAN OS 10.1.5-h1

Re: UI issues in PAN OS 10.1.5-h1

UI issues in PAN OS 10.1.5-h1

Re: Error in commit after upgrade to 10.1.5-h1

Re: Error in commit after upgrade to 10.1.5-h1

Re: Error in commit after upgrade to 10.1.5-h1

Re: Error in commit after upgrade to 10.1.5-h1

Re: Tenable Scan on Palo Alto firewall / Panorama

Re: Tenable Scan on Palo Alto firewall / Panorama

Tenable Scan on Palo Alto firewall / Panorama

Re: UI issues in PAN OS 10.1.5-h1

Re: Error in commit after upgrade to 10.1.5-h1

Re: Wildcard certificate for management interface access

Re: Strict IP Address Check after 9.1.12

Re: Telemetry error - CDL Receiver Key Empty

Re: Error in commit after upgrade to 10.1.5-h1

Re: HIP Notification question

Re: HIP Notification question

Re: Strict IP Address Check after 9.1.12

Re: PAN OS 8.1 support after March 1st 2022

PAN OS 8.1 support after March 1st 2022

Re: SSL Decryption with iOS 13 Devices

Re: SSL Decryption - replacing Forward Trust Certificate not working for IOS devices

Re: SSL Decryption with iOS 13 Devices

SSL Decryption - replacing Forward Trust Certificate not working for IOS devices

debug dataplane reset ssl-decrypt certificate-status command

Re: Telemetry error - CDL Receiver Key Empty

Re: Issues with Device Telemetry

Telemetry error - CDL Receiver Key Empty

Cortex XDR Broker VM questions

Re: Unable to sign into GP client with Azure AD SSO

Re: Unable to sign into GP client with Azure AD SSO

Re: Unable to sign into GP client with Azure AD SSO

Unlock your full community experience!

About Ben-Price