About aleksandar.astardzhiev

aleksandar.astardzhiev · ‎09-14-2023

Hi @JiaXiang , I believe you are not interperting the findings from your VA scan properly. The link you mentioned will effect how PAN firewall is performing SSL decryption, while I am expecting your VA scan to have report that PAN firewall admin WebUI is using server cert with short key. What you are probably looking for is here - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmqeCAC

aleksandar.astardzhiev · ‎09-14-2023

Hi @AkashThangavel , Having separate Virtual-Routers for the two ISP should work for Internet failover. As @ozheng and @149999mah3 already mentioned you don't really need to have two separate VRs, but it should still work. Main VR: - Assign primary ISP interface in main-vr - Assign ISP interface to "Internet/Outside" zone - Assign LAN (to your internal networks) interface in main-vr - Create static default route pointing to primary ISP. Enable path-monitor on this static route - Create second static default route pointing to "next-vr secondary-vr". Set metric higher than the default (let say 50) Secondary VR: - Assing secondary ISP interface in secondary-vr - Assign ISP interface to the same "Internet/Outside" zone - Create static default route pointing to secondary ISP. (optional enable path-monitor on this static route) - Create static route for your internal summarized subnet (/8, /12, /16) pointing to next-vr main-vr. NAT Policy - Create rule: - Source Zone "LAN/Internal" and source summairized internal subnet - Destination Zone "Internet/Outside" and dest address any - (Must) select egress interface to be the interface connected to primary ISP - Enable Source translation to public from primary ISP - Create second NAT rule: - Same source lan zone and subnet - Same destination internet zone and any address - (Must) Select egress interface to be interface connected to secondary ISP - Enable source translation to public IP from secondary ISP When using primary ISP: - Traffic from internal users will enter main-vr - Traffic will follow default route with lower metric and egress to primary ISP - First NAT rule will be used, because traffic will match the egress interface and apply translation to public IP from primary ISP When primary ISP is down: - Path-monitor will detect issues and "deactivate" the static route to primary ISP - Traffic from internal users will enter main-vr - Traffic will follow second default route pointing to next-vr (because it is currently only default available) - Traffic will enter secondary-vr and follow default route pointing to secondary ISP (as only availalbe default in that vr) - Second NAT rule will be applied, because traffic is now egressing via interface that does not match first NAT. This will apply translation to public IP from secondary ISP When primary ISP is restored: - Path-monitor will detect the availability of the monitored IP and will restore the default route - Traffic from users will follow restored route to primary ISP - First NAT will be applied as it will match the egress interface

aleksandar.astardzhiev · ‎09-14-2023

Hi @Alpalo , The certificate are form of authentication. Which means they are used when user is initiating a connection to the firewall. Revoking certificate does not affect currently established connection, the same way as disabling user account would disconnect the user if he has connected with username and password. You need to manually disconnect the GP client from the gateway - if there is currently established session. To prevent the user from connecting again you need to enable CRL or OCSP check in Ceritificate Profile that you assign for your GP Portal/Gateway. Look at section 8.Certificate Profile, step 7 on the following link - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFoCAK 7. (optional) Check CRL or OCSP if the portal/gateway needs to verify the client/machine cert's revocation status using CRL or OCSP. Please use this with caution as it can result in clients failing to connect if used in conjunction with 'Block session if certificate status is unknown'. Note that above is assuming you are using internal PKI, to which firewall has access from its dedicated mgmt interface. If you are using self-signed CA that is generated by the firewall you will need to enable OCSP reponder as described here - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIzCAK

aleksandar.astardzhiev · ‎07-28-2023

Hi @Didar_Bajwa , The best way to understand what could be the reason for the dropped packets is to check the global counters - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CloNCAS What is the output of the global counters?

aleksandar.astardzhiev · ‎07-10-2023

Hi @AkashThangavel , The checkbox for "shared" doesn't mean this object is shared between all template/template-stacks in Panorama. Checkbox for Shared means this config will be applied in the root/shared VSYS if your firewall is configured with multi-vsys Sharing certificate between different template can be tricky because there is no direction relation between templates. What you can do is: 1. Create one template in which you define some global settings that should be applied to all managed FWs, like imported certificates 2. Create template-stack that add the global settings template and the template with the rest of each FW

aleksandar.astardzhiev · ‎07-10-2023

Hi @AnkitChhabra , As explained in the AWS deployment guide, once deployed VM does have password configured at all. Which means initial connection to FW needs to be using SSH keys https://docs.paloaltonetworks.com/vm-series/10-2/vm-series-deployment/set-up-the-vm-series-firewall-on-aws/deploy-the-vm-series-firewall-on-aws/launch-the-vm-series-firewall-on-aws I haven't use boostrapping for PAN FW in AWS and I cannot confirm, but have you tried to set admin password in the initial config?

aleksandar.astardzhiev · ‎07-10-2023

Hi @nikoolayy1 , To be honest I didn't fully understand F5 documentation in the github link. I am curios how exactly you have managed to deploy active/passive F5? If you configure two VIPs (same IP) on the two F5 VE, how the failover is performed? In my humble opinion since you are limited by the cloud the options are as follow: - Anything related to GARP, ARP or virtual MACs is out of the question .There is no way to have same IP on two VE/NVA (network virtual appliance) and reply on ARP or GARP to point the traffic to the second unit during failover. Which leave you with: - API calls to Azure and move the IP from one VM to another - Azure Load Balancer with the two FWs as LB pool. If you check some of the docs for "Cloud NGFW for Azure" it is actually using LB under the hood. Some other vendors support session sync for standalone units, which is absolutely perfect when you use Azure LB for FW HA. Sadly PAN are still getting there. It looks like HA Clustering is step in that direction - https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/high-availability/ha-clustering-overview but currently it is not supported for public cloud. I haven't really checked, but I wouldn't be surprised if Cloud NGFW for Azure wouldn't currently support GlobalProtect. But as I mentioned it is using LB sandwitch under the hood so it may be supported. Regarding GlobalProtect HA in Azure - since I cannot imagine any other way to have HA active/passive in Azure (excluding the API calls), I still believe the best option is to - run two standalone FWs - with public IP assigned directly to VM - Using DNS LB like traffic manager and perform health checks to direct user to primary FW and in case of issues DNS to resolve to secondary member. - Not using Azure LB will allow you to use IPsec for GP, With LB you will must use SSL One intersting issue I faced (well with AWS NLB, but it should be probably the same with Azure) - if you use LB for VPN, you may have issues with SAML

aleksandar.astardzhiev · ‎07-07-2023

Hi @nikoolayy1 , I don't believe active/active is an option for Azure at all. Yes, you can use internal LB, but you will need to have the two firewall running as standalone - without any session sync. This is actually what Palo Alto are suggesting in their Azure Reference Architecture. If my understanding is correct you cannot have any kind of floating IP, because PAN rely on MAC and ARP to move this IP, while Azure and AWS native components does not actually use MACs. I would say the following was a really good discussion about the same topic - https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/vm-series-in-azure-active-passive-or-active-active/td-p/532192 Cloud NGFW for Azure also sound really good - https://live.paloaltonetworks.com/t5/cloud-ngfw-for-azure/ct-p/Cloud-NGFW-for-Azure but I haven't look too much into details as I am afraid that the cost will be significatly higher.

aleksandar.astardzhiev · ‎07-07-2023

Hi @roma , The error message you receive actually tell the opposite - "Reason: User is not in allowlist" When you configure your Authentication Profile, there is a tab to specify list of users or user groups that are allowed to authenticate with that profile. Firewall will first take the provide username and compare it with this allow list. If it doesn't match any of the allowed users/user groups, FW will deny user authentication, without even sending the credentials to AD for validation https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/device/device-authentication-profile/configure-an-authentication-profile

aleksandar.astardzhiev · ‎07-06-2023

Hey @kindzma , All PAN portals are using some kind of SSO, so you are using same account for accessing LiveCommunity, Beacon, CSP, Hub and etc. So above applies for community account as well, you just don't have access to CSP. You do need to provide MFA once you login, but cookies should keep you log in. I just tested to close my browser and re-open it and I was still logged in, so your issue should be with something else.

aleksandar.astardzhiev · ‎07-06-2023

Hi @SuhaimiMohd , Yes, it will work. However general recommendetion is to use Transit Gateway (TGW) instead of VPC peering, mainly becaue TGW provides you with great scalability if you need to add more VPCs in the future. You may want to compare the cost of TGW vs VPC peering, as I don't know the numbers right now.

aleksandar.astardzhiev · ‎07-06-2023

Hi @KENZ2023 , Right of the bat I would say - here is your problem "■Environment MacBook Air Apple Silicon-M2 2023 macOS Ventura 13.4.1 Parallels 18.3.1 Windows 11 22H2 22621.1848 Palo Alto Networks GlobalProtect x64-6.0.4-26" It looks you are trying to install x64 version, while running your VM on M1 chip you will need ARM64 version. You are probably downloading this from your VPN portal address, right? Unfortunately this will allow you to download only x64 and x32 versions. So you need to download ARM-based version from Palo Alto Customer Support Portal - ask your firewall admin to download it for you.

aleksandar.astardzhiev · ‎07-06-2023

Hey @nadiasb , 5.2.8 should definetely work with Windows 10. I would personally prefer 5.2.13 (as it is the preffered by Palo Alto support - https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-p/258304 ). You may ask your support to provide you with 5.2.13 (they can download it manually from Palo Alto support portal), but I have little hopes that this will made any difference. I haven't seen such issue so far, but based on the above (compatiable version, msi downloaded directly from GP portal) I believe we can rule out a faulty installation package. Which means the probablem could be in your laptop missing some dependencies (which probably is obvious by the error you receive) To be honest I am not exactly sure what are GlobalProtect dependencies, but if you look here - https://live.paloaltonetworks.com/t5/globalprotect-discussions/globalprotect-5-2-6-available/m-p/401720/highlight/true#M1228 it may needs some .NET framework What I could suggest is to try to install GP again, but this time using command prompt. This will allow you to specify log file where GP installation package will write logs related to the installation process. Try the following 1. Open elevated (as Administrator) CMD/Terminal prompt in the same directory wher you have downloaded the GP 2. Enter the following command C:\Users\User\Downloads>msiexec.exe /i GlobalProtect.msi /l+ GPinstall.log This should generate text file (in the same directory from which you executed the command). If yes, can you share it here? Feel free to obfuscate any user/hostnames (but I don't remember such to be logged)

aleksandar.astardzhiev · ‎07-06-2023

Hi @kindzma , I would say this is probably unintentional mistake by using old "template". Long ago MFA for Customer Support Portal (CSP) was optional and every company had the option to choose if it should require users to use MFA or not. However Palo Alto decided to made MFA mandatory for all CSP accounts - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClN9CAK I cannot find any resource, but I remember there was some link (or was an email) that explained that MFA is now mandatory for all and you don't have option to create account without. Back to your question...I would describe it as old template when MFA was optionally enabled by your company, but actually now it is enforeced by Palo Alto.

aleksandar.astardzhiev · ‎07-06-2023

Hi @nadiasb , My initial guess was that you may be trying to install some old version of GlobalProtect which is compatiable with your OS. Windows 10 is supported by GlobalProtect for a very long time, so what ever version you are trying it should work... Or at least if you are trying one of the theses version - 5.1, 5.2, 6.0, 6.1 or 6.2 - https://docs.paloaltonetworks.com/compatibility-matrix/globalprotect/where-can-i-install-the-globalprotect-app As we still don't know what GP version you are trying I wouldn't rule this out, yet: - Can you ask your IT team - What GlobalProtect version is currently active on Palo Alto firewall? - You mentioned that you used GP before, but you remove it. Have you changed your OS since than?

Member Since	‎08-01-2017 11:18 PM
Date Last Visited	‎12-22-2025 12:06 AM
Posts	1,077
Total Likes Received	448

Online Status	Offline
Date Last Visited	‎12-22-2025 12:06 AM

Unlock your full community experience!

About aleksandar.astardzhiev