About TSilverline

TSilverline · ‎08-17-2019

If you have access to CLI, create a new authentication-profile using the set authentication-profile command. Then, assign the authentication profile to the user you want to login with using set mgt-config users *username* authenticaton-profile command

TSilverline · ‎08-17-2019

There is no method to return a display to the user that their DNS settings need to be updated. The NAT idea is interesting and maybe the best option besides expecting your users to eventually figure it out. I would certainly not use spoofing - and it wouldnt resolve the overall problem. Sure, Google's DNS servers are probably the most popular but there are infinite other options people could use that would break. Personally, I would just publish the policy that you don't accept static IP (or DNS) configurations and let users figure it out. But obviously, every organization is different.

TSilverline · ‎08-17-2019

The SSL certificate needs to be added to the Trusted Root Certification Authorities of all of your computers. I'd just use a self signed one from the firewall, but you can also get puicly signed ones, etc. This article covers the concept pretty well (I have no affiliation with Globalsign it just explains the concept well): https://www.globalsign.com/en/blog/what-is-ssl-inspection/ Regardless of which route you go, you will HAVE to push at least one certificate to get SSLi working. If windows, the easiest way do deploy these is using GPO. https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/distribute-certificates-to-client-computers-by-using-group-policy If MAC or linux, youd need some sort of orchestration tool (JAMF, etc) to push globally.

TSilverline · ‎08-17-2019

Trying to understand the issue. So you are saying that the ACE exam is not available under your normal account but is available under some different company account? Or you have two different logins to PAN? If you are sure you are in the right place and it is not showing as available you should reach out to the nextwave support team to investigate.

TSilverline · ‎08-17-2019

@Mick_Ball wrote: I have not needed to try this but could you not just add the domain name to the authentication profile and then change the username modifier to "%USERDOMAIN%\%USERINPUT%". The firewall will then see user fred smith as domain\fred smith. the only additional requirement may be to tell radius server to ignore or accept any domain. Foir some reason I didn't actually try at first this because you seemed to be speculating about the solution; but it was indeed the correct answer. After adding the domain prepend, the group mapping function started working and I am now able to use AD groups for RSA authenticated users in my security policy! No changes to RSA RADIUS server needed. Thanks!

TSilverline · ‎08-13-2019

Thanks again for your reply. Can you help me better understand what you mean by it being more a component of UserID? I understand the concept of mapping users to different agent configurations based upon groups - but i dont know how to use the groups of an authenticated RSA user for this purpose because RSA doesn't appear return all of the users groups. This seems pretty straightforward using straight AD, or using local groups in the FW.. But I am not sure how to do it when authenticating against RSA. So, in your configuration, in which identity source are the groups configured? If AD, could you help me understand how you configured this? If somewhere else, can you explain how you configured the groups and got it all working? Thanks!

TSilverline · ‎08-12-2019

Check Point should be able to tell you why it's dropping the packets. I would start there and figure out what it doesn't like and then determine how that is happening to the packets.

TSilverline · ‎08-12-2019

Make the interface you want to attach the service route to a redundant (aggregate ethernet) interface.

TSilverline · ‎08-12-2019

What are you trying to NAT? The description has the same destination translation as destination address.

TSilverline · ‎08-12-2019

This is certainly supported now. Can you probide more details on what you would like to do and what's not working? https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/networking/dhcp/dhcp-options/dhcp-options-43-55-and-60-and-other-customized-options.html

TSilverline · ‎08-12-2019

Thanks for the reply. Did you then use the groups returned in your security policies? Or did you have multiple portals/gateways handing out different IP address ranges authenticating different user groups? Or did you simply allow/deny access based upon group membership?

TSilverline · ‎07-31-2019

I have setup Global Protect with RSA SecurID authentication. I would like to use the Active Directory groups of these users in my security policy to then allow or deny access to resources based upon their membership. I have configured the group mapping settings and the firewall is pulling in the AD groups. However, the policies I have created are not being matched. It appears since the authentication is via RSA it is not associating the user with the AD groups it is pulling via the group mapping since the user is not associated with the domain. I found this article which is relating: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClQdCAK but it only seems to be working for the initial authentication, not for actual security policy access post authentication. IIs there a way to get this working or is there a better method for restricting resource access based upon group membership when authenticating via RADIUS to RSA SecurID?

TSilverline · ‎07-17-2019

I still don't see any way of using these methods to evaluate whether browser or java versions would be up to date. Especially since the registry key only offers an exact match of a specic value this whole process seems limited. Only thing I think could be done is to create dozens of HIP checks matching every single version released and constantly update the firewall every time a new version is released. This sounds completely unrealistic. I would like t a way to do this like the patching or antivirus options which let you say if my patches are out of date for X days I match the Av out of date HIP object. There's no way to say if my version of Java is horribly out of date and I am vulnerable to exploits not to allow a connection?

TSilverline · ‎07-16-2019

Thanks for the replies but these steps aren't really getting me to what I need. When I do the custom check all it says is whether or not the browser exists or is installed on the system. That registry key shows the value, but the PAN won't just grab the value, it will only try to match on it. Am I missing something? Customer also has requested similar functionality around Java versions. This seems like a reasonable request but can't find any way of doing it. Any other thoughts?

TSilverline · ‎07-08-2019

I have a customer that would like to limit GP authentication based upon browser version running on the clients. They would like to collect all browser versions and then start blocking connections from clients below minimum settings. Trying to figure out how to do this but not seeing any straightforward method to collect all web browser versions. Any thoughts?

Member Since	‎11-06-2016 06:42 PM
Date Last Visited	‎10-29-2021 12:28 PM
Posts	41
Total Likes Received	7

Online Status	Offline
Date Last Visited	‎10-29-2021 12:28 PM

About TSilverline

HIP Checks / 3rd Party Clients

Re: HIP Checks for Browser Version

Re: Fireeye iSight

PAN MGMT interface initiating SSH connection outbound to strange destination

Panorama Frustrations with Global Protect

Global Protect Linux Custom HIP Check - Process

Global Protect with Multiple Portals - Transparent Configuration

Re: Setting All traffic of a specifif URL to the primary ISP

Re: Panorama reset Authentication Profile (Certificate Profile based Authentication) via CLI

Re: Document on VM information sources for Windows User-ID Agent?

Re: Fireeye iSight

Global Protect with Multiple Portals - Transparent Configuration

Re: SSL Outbound decryption - Outbound traffic

Re: SSL Outbound decryption - Outbound traffic

Re: How do you deal with Service Route and MGT port redundancy?

Re: Global Protect with Multiple Portals - Transparent Configuration

Re: HA2 Backup Port Link Speed

Re: Altering Cloned Template Changes Original?

Re: Blocking/Alerting on Web Sessions to IP Address Formatted URLs

Re: Blocking/Alerting on Web Sessions to IP Address Formatted URLs

Re: Panorama reset Authentication Profile (Certificate Profile based Authentication) via CLI

Re: DNS Block and Notification on Specific Networks

Re: SSL Outbound decryption - Outbound traffic

Re: Cant find option to take ACE exam

Re: Global Protect with RSA SecurID and Group Mapping for Security Policy

Re: Global Protect with RSA SecurID and Group Mapping for Security Policy

Re: TCP issues when moving an application through a Palo Alto FW

Re: How do you deal with Service Route and MGT port redundancy?

Re: NAT PPTP VPN

Re: DHCP Options

Re: Global Protect with RSA SecurID and Group Mapping for Security Policy

Global Protect with RSA SecurID and Group Mapping for Security Policy

Re: HIP Checks for Browser Version

Re: HIP Checks for Browser Version

HIP Checks for Browser Version

Unlock your full community experience!

About TSilverline