About CafNetMatt

CafNetMatt · ‎01-25-2016

Sorry for the delay. So the choices become: 1. Manually chained. Then the Mac's keychain will show the certificate as complete. 2. Leave as is. The client gets no error during GP login but the keychain on the machine just shows the cert signed by an unknown CA. User's don't actually go there to check anyway. They just don't want to see those pesky pop-ups about untrusted cert. So, I'm going to leave it as is. Thank you for the response.

CafNetMatt · ‎01-14-2016

But I'm seeing it doesn't add it to the local keychain on the PC. Only the client certificate is being added. Shouldn't the Root CA be added to the keychain? Regards, Matt

CafNetMatt · ‎01-14-2016

That's what's weird. I thought it pushed the Root CA to the client. When I check Keychain on my Mac, the client's certificate is there but the CA Root is not. The client certificate just shows that's it's signed by an unknown signer. I searched the keychain and could not find the Root CAs that should be being pushed down. Regards, Matt

CafNetMatt · ‎01-14-2016

This is on a PA-3020 running PAN-OS 7.0.4. I've always manually chained certificates when installed an SSL certificate for Global Protect. I decided to see if I could install the SSL certificate and the Intermediate certificates separately and see if it would work. I configured Global Protect Portal > Agent Configuration > Trusted Root CA with the GoDaddy G2_G1 certificate provided by GoDaddy. When I log into Global Protect, I do not get the 'untrusted certificate' error. However, when I check Keychain on my Mac, it only shows the client certificate installed, not the GoDaddy intermediate, and the certificate is labeled as 'signed by unknow authority'. My questions: 1. Does the Global Protect client just check the Trusted Root CA but not push the certificate down to the client? 2. Is it still recommended to manually create the certificate chain or use this method? The reason I'm trying not to chain them is because the client wants his SSL certificate to update via OCSP and it just doesn't do that if it's manually chained. Thanks.

CafNetMatt · ‎12-15-2015

I know this is old but I felt that some type of reply should be made. I'm dealing with the same issue for a client with the only difference being they have multiple ELBs to deal with. I started a new post hoping that would help get a response. Here's the link: https://live.paloaltonetworks.com/t5/General-Topics/PAN-AWS-with-multiple-ELBs/m-p/69415#M40288 Anyway, I brainstormed with other PAN engineers and it just isn't viable at this time. Hopefully as Amazon adds features to ELB and Palo Alto continues their development of the product it will become viable. Here's the issues we discussed: 1. The Palo Alto VM is limited to 1Gb throughput. I don't see this being any different for any other vendor because its limited to IO, vCPU & vRAM provided to any AMI. The point behind ELB and especially auto scaling is performance (& fault tolerance). The AMI becomes a bottleneck. 2. You've created a single point of failure. Traffic has to go through a single ENI on the firewall. 3. Auto-scaling. The firewall would need to dynamically create new NATs every time a new instance is spun up and everything that goes along with that. From an architecture standpoint, if you put the firewall in front the of ELB (use an internal ELB instead of Internet ELB) that would solve some issues but you still have the bandwidth/performance issues to deal with. Matt

CafNetMatt · ‎03-18-2015

Sorry to bump this after so long but what I wanted to do is relevant. I wanted to just change ports on an existing app without having to use 'Any' or have to list all ports for the application and it's dependencies. I was hoping to create a custom app with the original app as the parent and just list the port it would use. I believe the Application Override suggestion above would be needed. From reading the documentation, you have to include a signature in the custom app. The only time you do not is if you're using it in an Application Override policy. That's kinda a bummer. Thought I'd get off easy. What I'm hoping is that I can build a custom app with the built-in app as the parent, create an Application Override just for that new app and in the security policy add the built in app & the custom app. I've seen custom apps built without signatures and they always end up including all the ports from the original app, an Application Override created and the original app then not used. This seems to be no different than just creating a Service Object because signatures are no longer used; just ports. This is where being able to clone a built in app would be helpful. :smileylaugh:

CafNetMatt · ‎02-14-2015

This was a bust. It's just outside what Captive Portal was created to do. The client moved to a different solution. Sorry for the late response. For some reason your reply didn't end up in my inbox (The PAN inbox yes; my regular mail inbox no).

CafNetMatt · ‎08-11-2014

At least I know I'm not going nuts or completely incompetent. :smileysilly:

CafNetMatt · ‎08-11-2014

Sounds like you answered your own question but here's what I did. I only have DNATs & SNATs. The DNATs were port translations mainly because 1 was legacy and the other I only had the interface IP to work with. The performance issues I never had a chance to troubleshoot. The migration was a rush job and I was fitting into several already scheduled projects. By the time I had the time to troubleshoot, the client had work with PAN support to solve the issue. From what I understand, they spent a long time and several calls to figure it out but I never heard what the solution was. I have to LOL on the port 25. I didn't know anyone still blocked 25 anymore on a business class internet connection. Even if it's just a cable modem connection. 🙂 Although, on this particular job, they had a 100Mb cable modem connection and the provider was still tying the connection to the first MAC address it saw. That was fun.

CafNetMatt · ‎08-11-2014

The ISPs were put into the same zone. That was about the only nice thing about it. It made applying security policies easier.

CafNetMatt · ‎08-11-2014

I had a client that had a similar requirement. They have 2 ISPs with NAT separate for each. They had a couple of DNATs and wanted to use Global Protect as well. The fun part was that they wanted failover setup but they wanted both WAN links available at the same time. The plan was to manually change DNS when there was a failure but once it was back online they didn't have to make the DNS change right away. So DNATs & GP would always operate. What I had to do was to put both WAN interfaces into separate VRs. Since I was doing failover as well, I also had to setup PBF. It was the only way I could keep routing synchronous. When I tried to create PBFs to do it they just wouldn't honor the rule and if traffic came in on 1 WAN link while the failover PBF was in place routing became circular. I also had to setup routing across VRs to make traffic flow properly and ran into performance issues.

CafNetMatt · ‎08-11-2014

I have a client in the same dilemma. They are all Mac using Apple Servers running Open Directory to handle user authentication and profiles. What I've found is that the Open Directory server does not log user login / logout information so there is nothing in syslog on the Open Directory server to support User to IP Mapping. This is a change that Apple implemented, I think, in 10.8 Server. So the user login is only recorded on the local computer. I also haven't found a way to enable user login logging on the Open Directory server. My client is considering using Open Directory for handling user profiles and using Active Directory to handle user authentication just to be able to get user to IP mapping info.

CafNetMatt · ‎08-11-2014

Hi All, I recently migrated a client from a Fortinet firewall to a PANW. Most of the Virtual IPs from the Fortinet were migrated as bidirectional Source NATs. One specific server had issues where outside traffic would intermittently not be able to connect with the server. I troubleshot the issue and couldn't find anything wrong with the NAT or anything else. The client opened a ticket with PANW support. The support tech broke the bidirectional NAT into separate a SNAT and DNAT. The DNAT is interesting in that the traffic from the outside is being SNAT'ed to the LAN interface on the firewall using dynamic-ip-and-port and then a destination translation to the inside server address with a port translation back to 443. The SNAT is normal except is was also created using dynamic-ip-and-port to the server's public address. here's the XML config for the DNAT: <entry name="Server"> <to> <member>Outside</member> </to> <from> <member>Outside</member> </from> <source> <member>any</member> </source> <destination> <member>server-NAT</member> </destination> <service>any</service> <nat-type>ipv4</nat-type> <to-interface>any</to-interface> <destination-translation> <translated-address>server-inside</translated-address> <translated-port>443</translated-port> </destination-translation> <source-translation> <dynamic-ip-and-port> <interface-address> <ip>10.1.1.250/24</ip> <interface>ethernet1/4</interface> </interface-address> </dynamic-ip-and-port> </source-translation> </entry> This fixed the issue. Can someone provide some insight as to why and what the issue actually was? I'd just like to know for the future. The support tech didn't provide the "why" to the client. Gracias!

CafNetMatt · ‎04-26-2014

So, I got access to a PAN FW that I could use for testing and answered my question. For anyone else who happens across the issue here's what I found. You can't use the bi-direction button. You have to create separate NATs for the DNAT & SNAT portions. These are the NAT configs to be as close to bi-directional as possible. Outside IP is 2.2.2.2 and the inside server IP is 192.168.10.2 Static Src Zone Src IP Dst Zone NAT IP (bi-drectional = no) Inside 192.168.0.2 Outside 2.2.2.2 Translated Translated Src Zone Src IP Dst Zone Address Port Outside 2.2.2.2 DMZ 192.168.10.2 any For the SNAT using a single IP NAT pool: Src Zone Src IP Dst Zone NAT IP (dynamic IP & port) Inside 172.16.0.1/24 Outside 2.2.2.3 The security policies listed above are correct.

CafNetMatt · ‎04-18-2014

Figured I'd reply with the answer just in case anyone else has the same question. There's a post out there that discusses making sure to fill in the NetBIOS domain name in the 'domain' box in the authentication profile. This applies not just to LDAP but to RADIUS. When you fill this in you will get the DOMAIN\userid in the traffic log and security policies based on a domain security group work.

Member Since	‎06-18-2012 02:51 PM
Date Last Visited	‎05-03-2025 03:47 PM
Posts	72
Total Likes Received	6

Online Status	Offline
Date Last Visited	‎05-03-2025 03:47 PM

About CafNetMatt

GlobalProtect Multiple Auth Failed

DHCP Options for Mitel VoIP

Re: Implicit web-browsing and ssl

Implicit web-browsing and ssl

Re: Load Partial Config: merge vs append

Re: Load Partial Config: merge vs append

Re: Load Partial Config: merge vs append

Load Partial Config: merge vs append

Re: Can't remove vsys specific SSL TLS Service Profile

Re: Can't remove vsys specific SSL TLS Service Profile

Load Partial Config: merge vs append

Re: PAN Dual ISP Failver Best Practices

Re: PAN Dual ISP Failver Best Practices

Re: Custom APP based on existing

Re: NAT Performance Issue

Re: Load Partial Config: merge vs append

Re: Can't remove vsys specific SSL TLS Service Profile

Re: Can't remove vsys specific SSL TLS Service Profile

Re: NAT Performance Issue

Re: Trusted Root CA Not Installed on Client?

Re: Trusted Root CA Not Installed on Client?

Re: Trusted Root CA Not Installed on Client?

Trusted Root CA Not Installed on Client?

Re: How to architect Virtual PANs with AWS ELBs

Re: Custom APP based on existing

Re: Captive Portal to Internal Servers

Re: NAT Performance Issue

Re: PAN Dual ISP Failver Best Practices

Re: PAN Dual ISP Failver Best Practices

Re: PAN Dual ISP Failver Best Practices

Re: What kind of problems will I run into if I use Mac OS X server Open Directory?

NAT Performance Issue

Re: Bi-Directional NAT using DMZ instead of Outside interface

Re: Global Protect 2-factor Auth & User-ID Mapping

Unlock your full community experience!

About CafNetMatt