About TDC

Hi We have just completed an upgrade from PANOS 5.0.3 to 6.0.2. Everything seems OK with the exception of the GlobalProtect agents (and Shrew VPN) not being allowed onto the network. A successful connection is made by GlobalProtect but you can't connect to servers or see the network as everything gets dropped by a policy rule that drops everything coming from the Tunnel. What we do is have several different rules that controls which users can see which servers. As an admin I get to see the entire network. The rules use the 'source user' to decide what you can see. All fairly standard stuff and it was working fine when we ran 5.0.3. However since the upgrade everything gets dropped by the drop rule. To clarify the rules:- 1. Allow DNS traffic to the DNS servers. 2. Allow users A,B and C access to server one. 3. Allow users D,E and F access to server two. 4. Drop all traffic from the Tunnel. When I monitor the traffic logs and filter to just look at stuff coming from the Tunnel zone I've noticed that there is nothing listed under the 'Source User' column (user accounts were listed under 5.0.3). The fact that the packets are dropped by the 'drop everything from the tunnel' rule this tells me that the source user isn't being seen by the policy (otherwise it would have been allowed by a previous rule). There is one rule (the first one) that allows DNS lookups and this rule works but the policy doesn't use Source User in its settings. I've checked that UserID is enabled still on the Tunnel interface and the following command returns the correct data for 'domain' and 'user':- show user ip-user-mapping ip 10.10.100.19 IP address:  10.10.100.19 (vsys1) User:        domain\user From:        GP Idle Timeout: 10558s Max. TTL:    10558s Groups that the user belongs to (used in policy) When I look at the System logs I can see the GlobalProtect agent connect and it shows the correct user account details. I see UserID's correctly on the LAN interface so UserID is working. Anyone got any thoughts as to why after the upgrade the Source User isn't being seen by the policy? As I said, it was working fine in 5.0.3 and short of doing the upgrade, nothing has changed (I'm going through the config audit to confirm). Any help would be appreciated. Alan ... View more

Hi All I'm looking to replace our Fortigate 110c with a new PA-500 and I've managed to write the security and NAT policies which when tested seemed to work well apart from OWA. We have an ISA 2006 server which publishes OWA and OMA on a public IP and have configured the NAT rule and security rule as I did for all the other sites (like Citrix etc) which work fine. The NAT rule looks like:- Source Zone:- DMZ Destination Zone:- Internet Source Address:- ISA_Server Destination Address:- Any Service:- service-https Source Transalation:-     static-ip                                        NAT_ISA_Server_Public                                        bi-directional: yes The associated security rule basicaly allows all https traffic to NAT_ISA_Server_Public from the Internet and I log at session start and end. This is basicaly the same as the Fortigate config. When I try and connect to OWA I get a timeout. I jumped on the logs to see whats happening and saw that the NAT rule seemed to be working. I then checked the ISA firewall logs and was seeing connections being dropped for packet spoofing. So why would the packets forward by the PA-500 be seen by ISA as being spoofed when the packets forwarded by the Fortigate aren't? Putting the Fortigate back in place and OWA started working fine again. I'm desparate to get rid of the Fortigate and get the PA-500 working in production (something I'm going to have to do on Tuesday 18th). So I guess my questions are:- Can anyone see what I've done wrong in the config of the PA-500 that stops ISA from working? Should I be using ISA? Can I just forward directly to Exchange? If so what are the best practices for doing this securely? Any help or advise on OWA/OMA publishing would be appreciated. Cheers Alan ... View more