About LukeBullimore

Hi Stephen,   Has "local/peer identification" been configured on the peer device with the matching confgiuration?   What error messages do you see in the system logs when attempting to use FQDN?   Thanks, Luke.       ... View more

Very unlikely that an App-ID will be created for this; best way would be to create a custom App-ID   https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/app-id/use-application-objects-in-policy/create-a-custom-application#id2c3155f5-7aa9-44dc-a049-1485a971189c ... View more

Hi,   There is definitely something wrong with the certificate chain. The primary certificate looks to be signed by the root CA and not the intermediate. The primary certificate also marked as "certificate authority".   What I would expect   Root CA (Common name can be anything), marked as Certificate Authority Intermediate CA (Common name can be anything), marked as Certificate Authority, signed by root CA Primary Certificate (Common name is IP address), not marked as Certificate Authority, signed by intermediate CA.   Then attach the primary certificate to a SSL/TLS profile; attach this profile to the "authentication" tab of any relevant portals and gateways.   Thanks, Luke.   ... View more

Hi.   This step is only necessary if the certs are self signed. If you check both check boxes "Install in Local Root Certificate Store" the GP client will install the certs in the trusted root CA store so the client trusts the certs.   Are your certs publically signed? If yes, this isn''t necessary. If you browse to GP portal do you get cert errors? If yes there is something wrong with chain.   Thanks, Luke.   ... View more

1. If you browse to the GP portal address, do you receive any certificate errors? 1.1 If yes, and this is a publically signed certificate, there is an issue with the certificate chain. From the screenshot you sent there is only one root certificate, when I would expect one more, the intermediate certificate.   1.2 If yes, and its a self signed certificate, no issue we will get to this next.   2. The common name of the certificate needs to match the IP address of the GP gateway as specified in Network -> Portals -> Portal name -> Agent -> Agent name -> External/internal -> Gateways -> "IP Address"   3. If yes to 1.2 then you can get the GP client to automatically import the root certificates to the machines trusted root store as per the below configuration. However as per point 1.1 I believe not all root certificates are present on the firewall.   Network -> Portals -> Portal name -> Agent -> Trusted Root CA   Select the boxes "Install in Local Root Certificate Store"   Thanks, Luke. ... View more

Make sure to check your default outgoing NAT rule as well. If it is set to source translate to the interface address then you will be fine, otherwise the configuration will need to be amended to your new public IP range. ... View more

Further to reapers suggestions. You could create subinterface on the firewall with a different zone and zone protection profile attached? ... View more

After configuring the new zone, did you create a security policy rule to allow traffic? e,g,   from: VPNZone source: any to: any destination: any application:any service: any action: allow ... View more

HI,   You mentioned you applied your tunnel interface to the "Trust" zone. Is there a possibility that your VPN traffic is being NATted?   What happens if you make a new zone for the tunnel interface?   Thanks, Luke.   ... View more

Hi,   We had a similar thing with Avast in the past - upon speaking with TAC the resolution in 99% of cases is to upgrade the GP client. Do you get the same behavior on GP 4.1.1 for example?   Thanks, Luke.   ... View more

Hi Gerben,   I have previously had this issue with a log file, the fix in our case was to restart the corresponding process. Does ikemgr.log come back if you restart the ikemgr process as per the below?   debug software restart process ikemgr   Thanks, Luke.   ... View more

Do you get the same behavior if you add both the long and short group name to the allow list?   Considering the default group mapping refresh interval (default 60 minutes) you ,may need to initiate a manual group mapping refresh via:   debug user-id refresh group-mapping all ... View more

Creating a Deny-All rule is bad practice, don't do it. If there is intrazone traffic (Trust to Trust for example) that has not been allowed by a previous rule, this will be denied because your Deny-All rule will be matching before the Intrazone-default rule.   You don't need to make a deny-all rule to see denied traffic, you can actually click the click the default intra/interzone-default rules, click "Override" next to the Clone button at the bottom to edit them, then you can enable the "Log at session end" options under the Action tab. ... View more