This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences

About bsanders

cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.
bsanders
‎05-13-2016
since ‎10-19-2011
L2 Linker
User Activity
User Profile
Latest posts by bsanders
View All
My Liked Posts
View All
User Badges
Community Statistics
Member Since ‎10-19-2011 02:42 AM
Date Last Visited ‎05-13-2016 05:39 AM
Posts 35
Total Likes Received 2

2 site-2-site tunnels between 2 PAN devices

by in General Topics
‎03-06-2014 05:31 AM
‎03-06-2014 05:31 AM
Hello all, Would it be possible to setup 2 site-to-site tunnels between 2 PAN devices? I’d like to have 2 “parallel” tunnels to split the traffic in 2 different zones. Regards, Stephan van der Plas ... View more
Labels:

Cannot set new certificate to portal

by in General Topics
‎12-11-2013 07:51 AM
‎12-11-2013 07:51 AM
Hello all, Because of a domain name change, I created a new CA certificate on the PA500 which is our portal. I set this certificate as server certificate in the Portal settings. I committed, restarted the web-server and sslvpn processes. But the new portal website still has the old certificate. How can I make the new certificate active on the portal? Regards, Stephan van der Plas ... View more
Labels:

GP client connected to internal GW - no user attached to IP address

by in General Topics
‎11-22-2013 01:05 AM
1 Kudo
‎11-22-2013 01:05 AM
1 Kudo
Hello all, I was thinking that when a client is connected via GP to an internal Gateway, the user is mapped to the IP address of the client. In my case, that is not working. The zone in which the client resides has user-ID enabled, but still the traffic is not stamped with the user-ID. Can someone help me troubleshooting? Regards, Stephan van der Plas ... View more
Labels:

Setting up second gateway: Gives Cert CN error

by in General Topics
‎10-11-2013 06:15 AM
‎10-11-2013 06:15 AM
Hello all, I have a (working) Global Protect Portal+Gateway envrionment. I am now trying to setup a gateway in a second datacenter. I have setup the same GP-cert and Client-Cert, cert_Profile and GP Gateway settings. The gateway works, when setting a portal on the second datacenter machine and logging on through it, but not when using the original portal. I see in the client logs it is trying to connect, and then gives me this error: (T5312) 10/11/13 15:11:40:830 Debug(2597): winhttpObj, HandleHttpsRequest, url = / (T5312) 10/11/13 15:11:40:830 Info (1914): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_HANDLE_CREATED, this=0000000002D2C320) (T5312) 10/11/13 15:11:40:830 Info (1914): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_HANDLE_CREATED, this=0000000002D2C320) (T5312) 10/11/13 15:11:40:830 Info (2705): winhttpObj->SendRequest, first try (T5312) 10/11/13 15:11:40:830 Info (1134): winhttpObj, SendRequest, bIngoreClientCert=0 (T5312) 10/11/13 15:11:40:831 Info (1914): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_RESOLVING_NAME, this=0000000002D2C320) (T5312) 10/11/13 15:11:40:831 Info (1914): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_NAME_RESOLVED, this=0000000002D2C320) (T5312) 10/11/13 15:11:40:831 Info (1914): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_CONNECTING_TO_SERVER, this=0000000002D2C320) (T5312) 10/11/13 15:11:40:831 Debug(2984): send alive message now 3 (T2936) 10/11/13 15:11:40:886 Info (1914): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_CONNECTED_TO_SERVER, this=0000000002D2C320) (T6300) 10/11/13 15:11:40:892 Info (1914): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, this=0000000002D2C320) (T6300) 10/11/13 15:11:40:892 Debug(1981): WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, error=12044, result=5 (T5312) 10/11/13 15:11:40:893 Info (1170): winhttpObj, get WINHTTP_CALLBACK_STATUS_REQUEST_ERROR (T5312) 10/11/13 15:11:40:893 Error(1199): error = ERROR_WINHTTP_CLIENT_AUTH_CERT_NEEDED (T5312) 10/11/13 15:11:40:893 Info (1225): winhttpObj, set client cert name <bla bla>, remote.<domain>.com (T5312) 10/11/13 15:11:40:893 Info (1229): winhttpObj, reuse cert 000000000690D9E0 (T5312) 10/11/13 15:11:40:894 Info (1914): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_RESOLVING_NAME, this=0000000002D2C320) (T5312) 10/11/13 15:11:40:894 Info (1914): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_NAME_RESOLVED, this=0000000002D2C320) (T5312) 10/11/13 15:11:40:894 Info (1914): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_CONNECTING_TO_SERVER, this=0000000002D2C320) (T6300) 10/11/13 15:11:40:899 Info (1914): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_CONNECTED_TO_SERVER, this=0000000002D2C320) (T6300) 10/11/13 15:11:40:963 Info (1914): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_SECURE_FAILURE, this=0000000002D2C320) (T6300) 10/11/13 15:11:40:963 Info (1927): winhttpObj, dwCertError is: (T6300) 10/11/13 15:11:40:963 Info (1932): WINHTTP_CALLBACK_STATUS_FLAG_CERT_CN_INVALID (T6300) 10/11/13 15:11:40:963 Info (1914): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, this=0000000002D2C320) (T6300) 10/11/13 15:11:40:963 Debug(1981): WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, error=12175, result=5 (T5312) 10/11/13 15:11:40:964 Info (1170): winhttpObj, get WINHTTP_CALLBACK_STATUS_REQUEST_ERROR (T5312) 10/11/13 15:11:40:964 Info (1172): winhttpObj, ERROR_WINHTTP_SECURE_FAILURE set (T5312) 10/11/13 15:11:40:964 Error(1199): error = ERROR_WINHTTP_SECURE_FAILURE (T5312) 10/11/13 15:11:40:964 Debug( 768): Server <IP address 2nd gateway> cert chain has been created. (T5312) 10/11/13 15:11:40:964 Debug( 782): Server <IP address 2nd gateway> cert verification passed (T5312) 10/11/13 15:11:40:964 Debug( 806): Check server certificate revocation returns TRUE (T5312) 10/11/13 15:11:40:964 Debug( 895): The length of the serialized string is 986. (T5312) 10/11/13 15:11:40:964 Debug( 912): The encoded element has been serialized. (T5312) 10/11/13 15:11:40:968 Debug( 335): Active session id is 1 (T5312) 10/11/13 15:11:40:979 Debug( 103): Found PanGPA pid 3224 (T5312) 10/11/13 15:11:40:979 Debug( 107): Found active PanGPA pid is 3224 (T5312) 10/11/13 15:11:40:980 Debug(  63): pan_get_full_path(): full path in multibyte char is C:\Users\stephan.van.der.plas\ServerCert.pan (T5312) 10/11/13 15:11:40:981 Debug( 923): SerializeServerCert(): wrote 986 of 986 bytes to file C:\Users\stephan.van.der.plas\ServerCert.pan. (T5312) 10/11/13 15:11:40:981 Info (1914): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_HANDLE_CLOSING, this=0000000002D2C320) (T5312) 10/11/13 15:11:40:983 Info ( 516): wait for closing callback success! (T3520) 10/11/13 15:11:41:421 Debug(1869): enum result is 0000000000000000 (T3520) 10/11/13 15:11:41:421 Debug(1895): gbCheckInsertSmardCard is false, quit the enum loop (T960) 10/11/13 15:11:41:437 Debug(1869): enum result is 0000000000000000 (T960) 10/11/13 15:11:41:437 Debug(1895): gbCheckInsertSmardCard is false, quit the enum loop What can I do to make this work via the existing portal? Regards, Stephan van der Plas ... View more

Re: Global Protect Gateway Config Issue PAN-OS 5

by in General Topics
‎03-21-2013 03:47 AM
‎03-21-2013 03:47 AM
I have seen the same issue on a PA500 5.0.3. The Tunnel-mode checkbox could not be checked. CLI (set global-protect global-protect-gateway <gw_name> tunnel-mode yes) did work, but now there were some other problems. Deleting the GP Gateway config and creating a new did solve my issue completely, Still this must be filed as a bug. Reboot did not help b.t.w. ... View more

Stretching L2 VLAN's over IPSec tunnel

by in General Topics
‎02-14-2013 11:36 AM
‎02-14-2013 11:36 AM
Hi All, I am facing a nasty situation where i need to connect two sites together using an IPSec tunnel over the internet. The nasty part is where both sites have a VLAN that needs to be interconnected.. both in the same subnet. I am wondering if it is possible to stretch this VLAN between the two sites using an IPSec tunnel. This gives the following setup: VLAN1000 -> PA500 <-> (IPSec over INTERNET) <-> PA500 <-VLAN1000 Ideal would be QinQ tunneling where i could stack multiple VLAN's over this tunnel (even though i agree that preferably these sites would have routed interconnections ). Is there anyone familiar with a setup similar to this? Regards, Bas ... View more
Labels:

Re: SSO Requirements

by in General Topics
‎02-06-2013 11:15 PM
‎02-06-2013 11:15 PM
Hello all, I just received information from Palo Alto Networks, that SSO doesn't work on (VMware) virtual machines. This seems not to be a bug, but "a limitation". ... View more

Re: SSO Requirements

by in General Topics
‎01-09-2013 03:39 AM
‎01-09-2013 03:39 AM
Hello Same question: Were you able to fix your problem? What was the cause and/or the fix ? ... View more

Re: Globalprotect & Windows 8

by in General Topics
‎12-11-2012 11:55 AM
‎12-11-2012 11:55 AM
Hello, any idea when a fix will be there? Panos 5.0.1 did not solve it and has no new GP client. ... View more

Re: Pre-Logon Global Protect

by in General Topics
‎11-15-2012 03:23 AM
‎11-15-2012 03:23 AM
Hello all, Is there already a document in which is described how to set up the PA to make the pre-logon feature working? Regards, Stephan ... View more

Re: Captive Portal logon - Is it possible to disallow a user logging on from multiple devices?

by in General Topics
‎07-30-2012 01:42 AM
‎07-30-2012 01:42 AM
Hello rmonvon, Then I'd like to add a feature request for this functionality. Regards, Stephan ... View more

Captive Portal logon - Is it possible to disallow a user logging on from multiple devices?

by in General Topics
‎07-27-2012 08:01 AM
‎07-27-2012 08:01 AM
Hello all, We are in the process of setting up a Captive Portal. All works fine. When a user is member of a defined AD security group, she can log on to the captive portal on a device (Mac, PC, iPhone, Android, etc), which opens the way to be able to browse the internet from that device. The user can log on to various machines at the same time, without being logged of (and as such disconnected from the internet) on the first device when logging on on the second (and further) device. My question is: Is it possible for us to disallow a user to log on to the portal twice, by -1- logging of the user automatically on the other device, or -2- by denying the logging on when the user is still logged on to the first device? Regards, Stephan ... View more
Labels:

Re: SIP/RTP + NAT - One way audio

by in General Topics
‎02-28-2012 05:11 AM
‎02-28-2012 05:11 AM
Problem solved with a workaround! We used static source and destination translation which makes it work. NOT the way this should be done, but at least our PBX is happy now. Has been running for several weeks without any issue... Regards, Bas ... View more

Re: Netflow panos 4.1.0

by in General Topics
‎02-20-2012 02:56 AM
1 Kudo
‎02-20-2012 02:56 AM
1 Kudo
We are using scrutinizer and can happily inform you that every interface pops up correctly showing the exact interface name. We were amazed by the ammount of info available..  @PAN: GOOD WORK!!!!!!! Now from a different perspective i would like to know at what datarate the PA is capable of generating flow info.. Is there any info on this? Cheers Bas ... View more

Re: SIP/RTP + NAT - One way audio

by in General Topics
‎01-23-2012 01:05 PM
‎01-23-2012 01:05 PM
Hi, We are running 4.1.2 (with content version 270.1140) but have seen similar results with all other releases we had (4.0.5 and up). Currently we are examinating traces and noticed that the PA translates the source port in the STUN traffic coming from the PBX. Original: SRC PORT: 5060 DST PORT: 3478 Translated: SRC PORT: 30412 DST PORT: 3478 Why does the PA translate the source port? Possibly because port 5060 is below 10.000 and thus is registered for destination ports? From this point we stronly believe that this is where the PBX looses it. As we are now facing this configuration also on customer sites we are eager to solve this matter. Best regards, Bas Sanders Com1 Communication Solutions BV Netherlands Message was edited by: branders (added content version) ... View more
Register or Sign-in
Contact Me
Online Status
Offline
Date Last Visited
‎05-13-2016 05:39 AM
Latest Tags
No tags yet
Likes From
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2024 - Palo Alto Networks