About palomed

palomed · ‎03-14-2022

Up to now I've just had a single portal and gateway on an existing PAN 3220 pair. I had a couple of questions.. 1) What determines when traffic gets sent to the second gateway instead of the on-board gateway? 2) Can the same certificate be used for both gateways? I use certificate based authentication. The server certificate on the existing firewall is gp.acme.com - would this same certificate go onto the new gateway as well? I ask as the two gateways would have different IP addresses. 3) If the virtual PAN/secondary gateway was on the inside of DMZ interface of the hardware PAN, would it be still able to serve as the secondary gateway?

palomed · ‎03-07-2022

Per the steps in the guide, I cloned the default profile and set about to configure the DNS Signatures tab of the new profile. I believe that I want to sinkhole both the classic signature (with 100k rules in the firewall) and the newer DNS Security signature which will query PANs cloud database. But then to effect these actions I need to add a security policy where Actions/Profiles references my new Anti-Spyware profile which I named "DNS Security Profile". For this specific rule, should the Action be Allow? Deny? Drop? Other?

palomed · ‎02-16-2022

Outstanding. Thank you for the insight.

palomed · ‎02-14-2022

I have a GP user complaining about his GP sessions getting dropped. He's using certificate auth autovpn. The full error is [Error]: The network connection is unreachable or the gateway is unresponsive. Check the network connection and reconnect. Network discovery started. Now while that is going on, I see in Monitor/Global protect at that time is repeated messages of the client in pre-login before-login status and no IP address yet assigned. What is likely going on? Any other logs to review? Type Generate Time Event ID Stage Source User Source Region Public IP Public IPv6 Private IP Private IPv6 Client Version GLOBALPROTECT 2/14/2022 4:45 gateway-prelogin before-login ACME-67321211157 US 200.33.22.130 0.0.0.0 0.0.0.0 0.0.0.0 5.2.5 GLOBALPROTECT 2/14/2022 4:44 gateway-prelogin before-login ACME-67321211157 US 200.33.22.130 0.0.0.0 0.0.0.0 0.0.0.0 5.2.5 Client OS Client OS Version Repeat Count Status Login Duration Error Code Portal Sequence Number Action Flags High Res Timestamp Selection Type Response Time Windows Microsoft Windows 10 Enterprise , 64-bit 1 success 0 0 GP_Gateway 27604518 0x0 2022-02-14T04:45:07.499-08:00 Windows Microsoft Windows 10 Enterprise , 64-bit 1 success 0 0 GP_Gateway 27604477 0x0 2022-02-14T04:44:35.386-08:00

palomed · ‎02-11-2022

I am running the PAN as a vWire and trying to send traffic to Meraki VPN Registry at port 9350. Why does this traffic show up in Session Browser but not in Traffic Logs?

palomed · ‎02-08-2022

I have two PAN 3220s operating as Virtual Wires behind a pair of ASA 5525s. Normally in upgrading a pair of PANs you upgrade the standby, then suspend the primary (secondary takes over), upgrade the primary. Repeat as necessary to get to your target version. But since these are behind another HA pair, I'm concerned I could end up with a situation where I stop traffic flowing to the Active ASA member. I'm trying to go from 8.1 to 9.1 (or maybe 10.0). Would it be possible upgrade one PAN 8.1 to 9.1 and then suspend and upgrade the primary peer while also making the secondary ASA the active member of its HA? Or do you always have to upgrade each member of the PAN pair to just the next step of code. [ASA01]-in-if-----out-if[PAN01]-in-if----[Switch] [ASA02]-in-if-----out-if[PAN02]-in-if----[Switch]

palomed · ‎02-07-2022

All of our instant clones decided to update this morning and it's killing my Internet pipe. Is there a way I could limit the amount of bandwidth us for MS Update? Something fast and easy?

palomed · ‎01-26-2022

On my PAN 3220 which is handling Global Protect I am seeing a lot of Wildfire activity where the verdict for these file upload is benign, severity only informational but the action is to Block. Any insight as to what might be going on?

palomed · ‎01-25-2022

I've read a few posts on Split Tunnel by Domain Name. But so far I am only able to get specific routes to work and not split tunneling by domain name. My test is ipchicken.com as traffic to it will reveal either my home IP as the source or the corporate public subnet. I added to INCLDE *.ipchicken.com without specifying ports. After establishing the GP tunnel my browsing to ipchicken.com shows my home IP. I then tried also adding ports 443 and 80 to see if that might make a difference. Nope. My system is still showing my home IP address. Any recommendation on how to get this working? I figured to hit up the community before opening a case.

palomed · ‎01-18-2022

I checked the registry CBL as shown in the first site and that does not exist. HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\CBL . I do however see HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup Prelogon REG_SEZ 1 Portal REG_SZ gp.acme.com CurrentVersion REG_SZ 5.2.5-66 HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup\PreLogonStatus (Default) REG_SZ (value not set) ConnectedGateway REG_SZ gp.acme.com LogonState REG_DWORD 0xffffffff(4294967295) Do these look right? Again this morning when I logged in there was no pre-login status of the portal.

palomed · ‎01-14-2022

Hi BPry. You may be going a little over my head here. Can you give an example of what you mean by a provider? I don't think I've seen that problem. But maybe you're rephrasing something I've asked about - or correcting some term. Now as for Connected message - when you say "login provider is reading the status of PanGPS" - are you referring to Microsoft? The login page is the same login page Windows 10 presents to anyone. Except that since we installed GP w pre-login, if you client Sign-in options you'll see [GP][FIDO Sec Key][PIN][Password]. ..so what I'm not getting is that sometimes if I go to that login page it says just "Sign-in options". But other times it's showing the status. If I go into Task Manager I see background process GlobalProtect client and Global Protect service both running. Are you saying perhaps one of these is not running at the time I hit the login screen and that could be making the difference as to whether connection status is displayed?

palomed · ‎01-14-2022

Thanks Nikolay. So the pre-logon piece is actually working most of the time. The problems are the inconsistencies of the login page display and the occasional inaccurate claim of "Connected" when in fact it's not connected. Any thought why sometimes GP Connected/Not Connected status would show but at other times neither message would show?

palomed · ‎01-14-2022

Perfect. The last two used in combination verifies the #of IPs and users. Thank you.

palomed · ‎01-14-2022

When I login to my laptop computer - underneath my user name for sign in SOMETIMES is the status message: GlobalProtect Status: Connected (and under it the name of the GP portal/gateway.) But at other times I see no such message or "sign in options". If sign on options are there one includes the GP logo w check on it. A third issue now I've seen is where the status message "GlobalProtect Status:Connected" is misleading. If I open the gateway/users on the PAN I can see that in fact that my laptop was not connected. So two questions: 1) What governs when the GlobalProtect Status appears on the Windows 10 login page? 2) What might cause the GlobalProtect status to say Connected when in fact it is not? Bonus question: How to approach troubleshooting issue 2 since the false Connected message is occurring prior to login?

palomed · ‎01-14-2022

On a Cisco router the equivalent command might be "show ip dhcp bind" which would show a table of IP addresses assigned to what machine and are currently not available for assignment. I'm trying to find something similar at GUi or command line on the PAN to tell me the state of address availability for hand out.

Member Since	‎01-18-2017 10:54 AM
Date Last Visited	‎05-26-2022 02:43 AM
Posts	86
Total Likes Received	5

Online Status	Offline
Date Last Visited	‎05-26-2022 02:43 AM

About palomed

Can Cortex XDR proactively log Global Protect client debug?

Global Protect Gateway Priority Question

Portals and Gateways General Question

Configuring GP DNS in Agent/Client Settings vs Agent/Network Services

Run Diagnostic Tests for these Web Destinations

GP Debug Help

Global Protect False Negative Status "Portal Failed"

Global Protect w Azure SAML/MFA won't trigger logon dialog box

Global Protect Logs Cookie Expired Before Expected

Is there a way to delete for force expire a GP cookie?

How to Block RClone

Global Protect gateway is unresponsive

PAN Microsegmentation of DMZ

Re: Application Incomplete For One Site But OK at Another

Re: Global Protect Gateway Priority Question

Re: Upgrading PANs in Serial Question

Re: Meraki VPN Registry Traffic Not Visible in Traffic Logs But Can See in Session Browser

Re: PA equivalent of ASA packet tracer?

Re: Any way to throttle MS Updates

Second Global Protect Gateway

DNS Security - AntiSpyWare Profile/DNS Signatures/Policies Security Policy

Re: Upgrading PANs in Serial Question

Global Protect gateway is unresponsive

Meraki VPN Registry Traffic Not Visible in Traffic Logs But Can See in Session Browser

Upgrading PANs in Serial Question

Any way to throttle MS Updates

Wildfire Blocking on Informational

Split Tunnel by Domain Name is not working

Re: Global Protect AutoVPN and Windows 10 Login Screen

Re: Global Protect AutoVPN and Windows 10 Login Screen

Re: Global Protect AutoVPN and Windows 10 Login Screen

Re: How do you view IP Pool utilization to verify there's never more demand than available?

Global Protect AutoVPN and Windows 10 Login Screen

Re: How do you view IP Pool utilization to verify there's never more demand than available?

Unlock your full community experience!

About palomed