About darren_g

darren_g · ‎08-31-2016

Am i the only one who got the reutine email about content update 609 who can't find it? It's not online for a dynamic update check by the firewall, nor is it online for manual download as far as I can tell. Anyone else seeing this update MIA? Thanks

darren_g · ‎03-06-2016

Done that, and as far as I can tell the certificates are the right ones - I've only got one set defined on my testbed firewall, so and the HTTPS connection (to the portal) appears to be encrypted fine - I just can't login (to download the client or connect with Global Protect). Oh well. I'll keep plugging away at it. Thanks

darren_g · ‎03-06-2016

Hi. I'm trying to configure pre-authentication on my Global Protect portal. I've followed this document until I'm blue in the face, but every single time I attempt to logon to my test environment, I get GlobalProtect portal user authentication failed. Login from: AAA.BBB.CCC.DDD, User name: , Reason: client cert invalid, Auth type: profile. 03/06 21:55:38 GlobalProtect portal user authentication failed. Login from: AAA.BBB.CCC.DDD, User name: , Reason: client cert invalid, Auth type: profile. 03/06 21:55:31 Anyone got any hints on getting this to work? The annoying thing is I've had this working previously, but the certificates expired between my test and now - so I renewed them, re-imported them into my test PC - no good. Deleted the old ones, generated new ones (including a new CA certificate for the firewall), changed the required configutrations, imported the new certificates into my PC - nothing. Same error. Is there some more debugging I can enable somewhere to figure out where this is going wrong?

darren_g · ‎09-08-2015

OK, I've reconfigured appropriately, and will test the latest client to make sure it works. Thanks!

darren_g · ‎09-07-2015

> There is a change in the default behaviour in the global protect from 2.3.0 That's the answer I was looking for. There is a difference. > Validate means whether the certificate is signed by a CA which is trusted by that machine The certificate I am using is signed by an external CA, and the entire intermediate chain is included - it's not from a "top level CA", but the full chain is valid and checks out. Which is kinda why I couldn't understand why the 2.3 client wouldn't validate it. > When defining the gateways under the portal configuraiton. If CN have FQDN then specify the FQDN, If CN have IP address then specify IP address. Not sure what you mean here - when I define the portal, the name is the FQDN. Do you mean the "external gateway" name should also be the FQDN rather than the IP address of the gateway? Sorry this has taken a while to reply to - for some reason, I didn't get a notificaiton of your reply - I'll have to go and check my profile and make sure it's set to send them to me.

darren_g · ‎09-07-2015

> I guess that You havent properly installed ssl cert with intermidiate cert You guess incorrectly. The certificate was working fine on the old client - and checks out perfectly using your SSL checker page. Thanks anyway

darren_g · ‎08-30-2015

Folks. I upgraded my firewalls from 2020's to 3050's on the weekend (oh, and isn't it a joy to have firewalls that I can actually administer without waiting 20 minutes for something to happen on!), but I ran into a bit of a problem with upgrading Global Protect. My old firewalla ran the 1.2 client because I didn't want to load it up with anything extra - when I put the new firewalls in, I installed/activated the latest client (2.3.1), however it wouldn't connect - I kept getting an error about failing to verify the server cert - when I know my certificate on the SSL portal is valid (and obtained from an external registrar). Can anyone tell me if there is some difference in config or certificate requirements between the V1.2 client and the V 2.3 client that I missed when I tried the upgrade? Thanks.

darren_g · ‎08-18-2015

Folks. I'm about to upgrade my 2020's to 3050's (yay for new budgets!), and I'm trying to preserve the historical log data from my old firewalls by exporting and importing into the new ones. I've managed the export - at least, I'm pretty sure I have - but when I try and import, I get the following error after a period of time. ./dailythsum/1/20130225/ ./dailythsum/1/20130225/.intervals Exited log import mode 2015-08-19 13:43:50.268 +1000 Error: pan_slog_internal(pan_slog.c:132): modify failed: TIMEOUT 2015-08-19 13:43:50.269 +1000 Error: main(pan_slog_app.c:137): Can't send message to mgmtsrvr I have set the CLI timeout value to "never" before attempting to do the import. The new firewalls are on a temporary admin address while I get themr eady - I have already successfully exported the old config ad imported it into the new boxes, so I know that they're working and online OK. The only difference is that the new boxes are running 6.0.10, and the old 5.0.16 - is this the likely cause of the error? Can anyone shed any light on this is the software version difference is not the cause? Thanks.

darren_g · ‎04-07-2015

Just got the same thing, only with all the "Darren"'s, "Daryl"'s, "Dave"'s and a few others in the TO: Field. Methinks someone at Palo Alto made a major f-up.

darren_g · ‎12-07-2014

> -Also issues with normal commit due to config like Darren mentioned above. This was definitely the problem in my case - confirmed it now. It's annoying that this application definition just disappeared - with, from memory, no notifications (at least, I don't recall any of the recent notices for content updates notifying of this being changed) - although it *is* possible I missed it.

darren_g · ‎12-04-2014

> What PANOS are you using? I have one set (2020 HA cluster) on version 5 (5.0.11) and another (3020 standalone) on version 6 (6.0.2). I don't get upgrade windows very often, so I'm a bit behind - and I don't want to stress the already overworked 2020's by upping them to version 6 with its continued additional feature load on a management plane which can't keep up. > I'm doing the same ... but I'm thinking that is it useful I believe I found the solution to my problem last night (I'll have to wait for next week's content update to be 100% sure) - I had to make a config change for another, unrelated situation - and the commit failed. An application which I had in a defined application group apparently just ceased to exist - and the config commit was failing because of that. Part of the virus/content upgrade involves re-committing the active config to the device - and I think that is what was causing my upgrades to report an error. I'll check the next content update (I apply them manually because I've been bitten - badly - in the past by allowing automatic content updates to be done without oversight/vetting) and post a reply here I turn out to be right.

darren_g · ‎12-03-2014

Thanks. I'm attempting to get this to work on another interface. Cheers.

darren_g · ‎12-03-2014

Anyone else seeing this one? On both my firewall installations (2020 HA pair and 3020 standalone), the last two content updates (the failed one 473 and the replacement 474) are failing to complete, according to the job log, vis-a-vis Yet the relevant content update shows as "installed" in the dynamic updates page. Is anyone else seeing this? Or am I the only one who compulsively watches the install logs for content updates to make sure they work? Thanks

darren_g · ‎11-16-2014

Folks. I have a need to implement certificate based login for most of our corporate PC's to Global protect - so they pre-login and get domain scripts etc when the remote users logon. However, I also have a number of PC's which aren;t corporate owned (and, as such, I can't push certificates to) which still need to be able to login just using username/password interactive logins. One suggestion I have had is to run two Portals on the one gateway - one configured to run pre-login with certificates, one configured to just wait for username/password. Has anyone tried this? Is it even remotely possible? Can I run two portals on the same IP address with the different authentication methods? Any insight appreciated. I'm trying to experiment, but I'm wary of doing it live if I can avoid it. Thanks

darren_g · ‎09-24-2014

You can't upgrade the RAM on a 2000 series. I only wish you could!

Member Since	‎09-16-2012 09:05 PM
Date Last Visited	‎06-24-2025 04:02 PM
Posts	287
Total Likes Received	57

Online Status	Offline
Date Last Visited	‎06-24-2025 04:02 PM

About darren_g

Re: Block access on HIP check failure - how?

Block access on HIP check failure - how?

Network monitor shows huge traffic spike, but can't find traffic details

Re: LogDB Import failing - anyone suggest why?

Re: Split tunnel specific URL only, not entire site?

Split tunnel specific URL only, not entire site?

Re: Implications of "No direct Access to Local Network" toggle in Global protect client settings?

Re: Implications of "No direct Access to Local Network" toggle in Global protect client settings?

Implications of "No direct Access to Local Network" toggle in Global protect client settings?

Global protect DNS and Windows 10 Home

Re: Force HA failover - how?

Re: LogDB Import failing - anyone suggest why?

Re: Scheduled reports not working

Re: BGP sessions not exporting

Restricting VPN access to internal services on per-user basis

Re: IPSEC vsys cli

Re: HOWTO Wanted : Trunked L3 intrerface with tagged VLAN's

Re: HOWTO Wanted : Trunked L3 intrerface with tagged VLAN's

Re: IPSec VPN routing across multiple tunnels

Re: IPSec VPN routing across multiple tunnels

App and Threat content update release 609 MIA?

Re: Global Protect Pre-Authentication driving me nuts

Global Protect Pre-Authentication driving me nuts

Re: Diferences between Global protect 1.2 and 2.3 clients?

Re: Diferences between Global protect 1.2 and 2.3 clients?

Re: Diferences between Global protect 1.2 and 2.3 clients?

Diferences between Global protect 1.2 and 2.3 clients?

LogDB Import failing - anyone suggest why?

Re: Palo Alto Networks Content Updated email fail

Re: Latest content updates failing?

Re: Latest content updates failing?

Re: Two Global protect Portals on one gateway - possible?

Latest content updates failing?

Two Global protect Portals on one gateway - possible?

Re: high management CPU

Unlock your full community experience!

About darren_g