About kprakash

After you have configured the portal and the gateway, and when you download the client from the portal the first time, the client always comes with the portal IP address or the hostname, as shown in the screenshot. The installer file also contains the information of the gateway/gateways. You will always authenticate against the portal first and then to the gateways. You have an option though to change the portal IP address or the hostname, if you want to connect to another portal. ... View more

Here is one more helpful link: https://live.paloaltonetworks.com/message/27869#27869 BR, Karthik RP ... View more

Please follow the below doc: https://live.paloaltonetworks.com/docs/DOC-3255 Best regards, Karthik ... View more

Thanks for the clarification. What is the port number for which the traffic is getting marked as an Unknown-TCP ( I hope its not for 80 or 443 ). As mentioned earlier, we would see a traffic marked as "unknown-tcp", if the PANFW doesnt have the signature for that app. If its a different port number ( non-standard), create a custom app for the traffic on that port nunber, and use this custom app under an app override policy. When configuring the app override policy, specify the source zone and source IP as the users' IP, specify the destination zone and leave the destination address blank ( any address ), and configure the underlying protocol ( tcp/udp), the port number and the custom app created above. You can also create/ modify the existing security policy with source IP as the user's IP, and leave the destination IP to any, and  application any, and the action set to  allowed, to study the IP addresses and the ports that the client uses to establish a successful connection. You can then lock this rule down to the addresses and the ports based on the traffic log analysis. Hope that helps! BR, Karthik ... View more

I am assuming that you have a clean up rule configured, which lies on the end of the security rules list. If so, we certainly need this rule, because the PANFW has to communicate to the DNS servers via the interfaces configured ( and this communication is via the data-plane and is not considered host inbound or host outbound traffic ). ... View more

Also ensure that the addresses configured under the split tunneling and the IP address that they are assigned internally at their home ( through their wifi modem ) do not overlap. This will result in an ARP conflict on the adapters, and will result in unwanted routing issues. ... View more

If you are pinging directly from the firewall itself , as shown below, the firewall pings 8.8.8.8 via the management interface. The firewall uses the DNS servers configured under the management interface settings to resolve google.com to its IP address. >ping host 8.8.8.8, >ping host google.com The PA device will need a layer3 interface with an IP address to act as the DNS proxy, and your users will point to this IP address as the DNS server. PLease refer to the below links that have an answer to your question. https://live.paloaltonetworks.com/message/28716#28716 https://live.paloaltonetworks.com/docs/DOC-3522 https://live.paloaltonetworks.com/message/12588#12588 https://live.paloaltonetworks.com/docs/DOC-4633 Hope that helps! BR, Karthik ... View more

To answer you question, configure a NAT policy to NAT traffic on port 4500 for the VPN traffic. As mentioned earlier, you have to configure NAT traversal on both the  end routers ... View more

Good Morning, Applications like Ping and ESP, do not have port numbers and have their own protocol numbers. When the PANFW receives these packets, and if there is a NAT rule applied to perform both address and port translation, the PANFW drops these ESP packets ( because there is no port information in the ESP header. Also note that the PANFW drops these packets only if it is configured to perform address and port translation. If configured to translate just the addresses, like when using static NAT, the PANFW wont drop the packets ). If you want the PANFW to NAT the ESP packets, ensure that you have NAT Traversal configured on the end routers. With NAT-T configured, the routers encapsulate the ESP payload into a UDP PDU, which carries this information on port 4500. When the PANFW receives this packet, it can translate the port number and hence wont drop the ESP packets. Hope that helps. BR, Karthik ... View more

You could use an FQDN address object for that server, instead of an IP address, if it keeps giving us different IP addresses to connect to. You can create an FQDN address by going under Objects-->addresses--<new address> The PANFW will resolve the hostname to its IP address, and we should be able to connect to the server. In addition, gotoassist requires you to have SSL too, please include SSL under the policy too. Usually an Unknown-TCP would mean that the PANFW has seen the entire TCP hanshake complete, but did not see a couple of other packets in that flow to determine the application. ... View more

Thanks for the clarification, Per the screenshots, it appears that the users are connecting on port 443, whereas the destination NAT rule configured is for port 25. Can you remove the port 25 from the NAT rule ( Destination NAT to any port) , to see if it makes a difference? IN addition, I see that the traffic is being identified as "not-applicable". We usually see "not-applicable" when we are filtering based on service ports too. So for testing purpose, please modify the inbound traffic policy to permit traffic from outside to inside, with source address any, destination address as 46.140.150.154,  application set to ssl and smtp, and remove the service-port 25, and action allow. ... View more

Found one more link provides a more accurate solution to our situation. Destination NAT for a Network not Connected to the Firewall ... View more