About pandragon

As far as I remember, we can't run GlobalProtect and NetConnect concurrently on same PA unit. But a PC can have both clients installed concurrently and either of them can connect to different PA units running either GP or NetConnect. ... View more

You can create one rule (which needs to be identical on all devices) in Panorama for such situations. For example if you want a rule that says allow traffic from source named ServerABC which has different IP at firewallA, FirewallB, FirewallC. Create 3 different address objects in Panorama like ServerA with IP_Addr_A, ServerB with IP_Addr_B and so on. Then create an address group in Panorama like ServerABC that has members like ServerA, ServerB and so on. Presuming that network subnets under each firewalls are different and firewallA handles traffic from ServerA only (and so on for firewallB and FirewallC), such a workaround would serve the purpose. ... View more

Tried "Check Now" under Dynamic updates and it did not gave any error. system log also did not show any recent error for brightcloud. ... View more

One workaround would be use a separate web server to buy a wildcard certificate from Commercial CA with something like  *.yourdomain.com. Then export the certificate and private key file in PKCS or PEM format from that web server to PaloAlto firewall or Panorama. I think it may not be possible to generate CSR (Certificate Signing Request) from a PaloAlto firewall as I could not see any option to do that. Then the workaround like above helped. ... View more

You can try creating custom report under Monitor Tab - Manage Custom Reports. Then use Query Builder for query something like application not equal to dns. ... View more

It may be due to some Internet connectivity issue at your site. I checked using CLI command from one of the PaloAlto firewall as follows. request url-filtering download status vendor brightcloud And it shows result as follows. Nov 12 01:02:29 URL filtering database version 3979 is already the latest version ... View more

While automated converters do the bulk of job, such migration projects would need some additional "human" touch. It will be good to perform one round of manual analysis and use specific zones as source & destination rather than any. Other learning from such migration projects is that sometimes the source or destination is spread across all the zones hence we might be tempted to leave it as "any". It may be a good practice to select all zones by name rather than "any". Because subsequently in future, when we add new zones, we may have to spend more time in analyzing the impact on old rules with "any" zone. This little time spent will help in future troubleshooting of existing rules based on zone names. ... View more

We had a PA-2050 on software 4.1.1 for a few days and there was no slowness during commits. Anyway, 4.1.2 is now released so upgrading to 4.1.2 might help. I did not encounter any issue during 4.1.2 upgrade just now. ... View more

I think if user is not found by PA device in the group-name seen under "Allow List" then the system log will show "Authentication Failed: Invalid Username or Password". That may be misleading.If you set filter when viewing logs, as eventtype=GlobalProtect, then you might miss other log where eventtype=general. If you do not set any filter, does the log also show event=auth-fail and description like "user xyz failed authentication. Reason: User is not in allowlist"? It may be something like attached screen sample. ... View more

Then probably trial cert from commercial CA might help. ... View more

"Revert to Running Configuration" will help as you mentioned to discard current changes. Load named config will be applicable only if you have saved a named config or you want to revert to an older named config that you saved. ... View more

From your screen capture GP3.img, second line shows Root CA does not exist.So first line shows SSL_get_verify_result failed. As you are using self-signed SSL cert generated by PA device, the root is not present in the client. You may need to import the "Root" cert into the client PC. Probably opening the PA portal via browser and looking at the root (PA device) cert will allow you to save that root cert to local PC. Other alternative may be to try commercial CA's free trial certificate. http://www.globalsign.com is one such CA where you can get free trial cert. ... View more

During initial debugging, you may want to set "Update Interval" for "Group Mapping Settings" seen under "Device" tab - "User Identification". Click on the group mapping name and set "Update Interval" to something like 60 seconds (valid range is 60 to 86400 seconds). Then connect to the firewall using CLI via SSH client. Few useful CLI commands can be tried as follows: show user group-mapping state all show user group-mapping statistics In the output of above commands, check that "Number of Groups" is not zero. If it is zero, verify that you are not using * as wildcard under "Search Filter" field in Group Mapping configuration. For example, if you are searching for a group starting with words vpn do not enter search filter like "vpn*" but just enter "vpn". Once the group mapping starts showing results, you can revert "Update Interval" to somewhat longer instaed of 60 seconds. Hope this helps. ... View more

You may need to verify your setting under Network Tab- GlobalProtect- Portal - Portal Configuration screen. "Client Certificate" should be "None" and you would need only the "Server Certificate". I think the earlier line in log "ERROR_WINHTTP_CLIENT_AUTH_CERT_NEEDED" would mean that you might have set something in "Client Certificate" field. An article at http://msdn.microsoft.com/en-us/library/windows/desktop/aa383770(v=vs.85).aspx provides more details about this error. ... View more