About Claw4609

Outside of minimum and maximum supported tls versions and ciphers what are some things to look for on SSL Labs that would be breaking decryption. In the Palo decryption logs if it shows error "Early close notify" what would be something to look for as the root cause? ... View more

We just spun up a panorama managed prisma access portal and gateway. Both the portal and gateway use either a certificate profile or saml for the authentication (the authentication on both the portal and the gateway match each other), however, when the certificate profile is attached to the gateway it returns a "Could not verify the server certificate of the gateway" error. The portal and gateway have the same certificate profile attached to them and you can log into the portal via certificate just fine.   We have on-prem gateways with certificate profiles attached and work just fine. Is there something else I need to do with it being a prisma gateway?    It looks like we're getting this error: Failed to verify server certificate of gateway XXXXXXX.gw.gpcloudservice.com. Show Gateway: Could not verify the server certificate of the gateway. If the issue persists, contact your administrator. Failed to retrieve info for gateway XXXXXXX.gw.gpcloudservice.com.     ... View more

It seems like guest users arent matching any groups with Cloud Identity Engine. We have SAML (Azure) setup for our GlobalProtect authentication (not throught Cloud Identity Engine). We have CIE configured on the firewall under user identification. The Cloud Identity Engine is configured to sync the Azure directory but if I look on the firewall using show user user-ids match-user it shows no groups. We have on-prem users that sync up to Azure and those pull groups fine however the guest accounts do not, so accounta we invite into Azure and arent synced on prem dont match any groups.   If I go to CIE itself I can see the user there and the groups they are a part of but the firewall doesnt pull any of those groups, the certain groups are used for different agent configs for GlobalProtect. Is there a reason if wouldn't be pulling the groups that it should need? Do I need to use a SAML auth profile through CIE itself?   Running command "show user cloud-identity-engine statistics all" returns Failed with error code: -20001   Configure the Cloud Identity Engine as a Mapping Source on the Firewall (paloaltonetworks.com) ... View more

We are having a large number of our PA-220s randomly crashing. No critical system logs are see shortly before the crash, the device just goes down and they are logs of dataplane starting up like 30 minutes later. Our other models are fine, its only the 220s we are having issues with. We have had a critical TAC ticket for the last few days and it was initially believed we were hitting a bug in 10.1.8-h2 so we were instructed to upgrade to 10.1.9-h1, that didnt fix our issue, we were then told to upgrade to 10.2.4 but that didn't fix our issue. We're currently communicating with TAC but we're just looking to get this issue resolved.   There were no changes pushed to the Palos shortly before this happened. We have been running 10.1.8-h2 for months with no issues.    I'm aware this is limited information, but anyone have any ideas. ... View more

We do not currently have SCEP set up in our environment nor are we familiar with it. But if we did have it set up would our PA firewalls be able to request a cert that we could then use in a SSL/TLS service profile to have a secure connection between our computers and the mgmt gui of the PA?   Deploy Certificates Using SCEP (paloaltonetworks.com) Configure Authentication Using Custom Certificates on Managed Devices (paloaltonetworks.com) ... View more

Is there something misconfigured with my packet buffer protection or is BPA and AI-Ops just flagging it incorrectly?     Configure Packet Buffer Protection (paloaltonetworks.com)   ... View more