About jambulo

It would be nice to disable certain ciphers not just for Global Protect, but for all traffic that passes through the firewall. ... View more

My "External Gateway" (under Global Protect > Portals > Client Config) is set to the IP address of the Gateway.  The Common Name of the certificate uses the FQDN. I didn't think this mattered, since the Client Config here does not get pushed to the iOS Global Protect Client. I'm currently on iOS Global Protect client 2.0.2(verified by checking in the "About" tab of the client).  I did not even know there was a 2.1.0.  Looking at my iPad now in the App Store, it does not say there is an update for Global Protect.  In the App Store, it also displays that the version in the App Store is 2.1.0.  It just does not let me upgrade to it. EDIT: I just uninstalled/reinstalled Global Protect and now I am on 2.1.0.  It looks like the App Store is not correctly updating Global Protect(it thinks it's up to date but it really is not). ... View more

I opened a case a little while ago, just waiting for a response.  I was just curious to see if anyone else is experiencing the same issue.  I also uploaded logs from the client and firewall. I am running iOS 8.1 and Global Protect 2.0.2. Right before I think the GP client disconnects, this is what I see in the PanGPS log... Debug(2569): Msg length is 2715. Sending POST /ssl-vpn/hipreport.esp HTTP/1.1 Info (2958): sent HIP report  to X.X.X.X Debug( 561): Network status changed: 10003 Debug( 565): Network is reachable, set net change event Debug(2699): NetworkConnectionMonitorThread: route change detected. Wait for 3 seconds. Debug(2986): Response status of HIP report  is success, gateway X.X.X.X Debug(2988): Hip report  returns success. Info (2802): Got hip notification from gateway X.X.X.X Debug(2809): Hip notification is empty in the HIP report check response from gateway X.X.X.X Debug(2817): SSL is disconnected. Returns TRUE. Debug( 860): SendHipReportToGateway X.X.X.X returns TRUE. Debug( 472): Failed to send response message to app Debug( 699): Send response to client with result 1 Debug(2469): HipReportThread: wait for HIP report ready event. Debug(2736): NetworkConnectionMonitorThread: m_state = 0, m_bOnDemand=1, m_bAgentEnabled=1, m_bJustResumed is 0, m_bHibernate is 0, m_bAgentEnabled is 1, m_bDisconnect is 0, IsConnected() is 1, IsVPNInRetry() is 0. Debug( 119): interface en0 ip X.X.X.X/X.X.X.X Debug( 537): Wifi interface is ready Debug( 542): Network rechability flag is 0x10003 Debug( 547): Network type is Wifi Debug( 797): Network type changed from 2 to 2 Debug( 119): interface en0 ip X.X.X.X/X.X.X.X Debug(2742): NetworkConnectionMonitorThread: Detected route change, but skip network discovery. ...nothing shows in the System Logs that my client was or did disconnect. ... View more

One way is to use the User-ID Agent to map AD usernames to IP addresses(the PA reads the AD auth logs).  Then, use the Group Mapping function to pull in users/groups from AD. EDIT: Just re-read your question.  The above will allow you to apply usernames to security policies, not the PA WebUI. ... View more

Why does the PA NOT detect SSLv3 when it's set to decrypt the passing traffic? Here's what I did to test... 1.  I forced my browser to user ONLY SSLv3. 2.  Set Threat ID 36815(SSLv3 Found in Server Response) to "drop-all-packets". 3.  Browsed to web server behind the PA and page loaded fine. 4.  Wireshark capture shows only SSLv3 being used. 5.  Not detected in PA. Then I tried web traffic that is not being decrypted and the PA detected and blocked the SSLv3 attempt. ... View more

Here is the output from  "show counter global | match syn" flow_inter_cpu_nat_mismatch            22592        1 info      flow      pktproc   Inter-CPU NAT sync mismatch ha_nat_policy_mismatch                104559        5 warn      ha        system    HA NAT session sync: policy mismatch ha_nat_pool_mismatch                     814        0 warn      ha        system    HA NAT session sync: IP/port pool state mismatch ... View more

I created a custom signature like csharma suggested and I can confirm that it works. Although, it does not seem to work if you are decrypting the SSL traffic via Palo Alto. ... View more

@slv That New Features Guide for 6.0 shows you how to configure the WINDOWS User-ID agent to accept Syslogs for mapping usernames.  Do you know if a Palo Alto on PAN-OS 5.x can take advantage of this Syslog/User mapping if we set it up on our Windows User-ID agent? ... View more