About welly_59

We rolled out a vpn solution with “on-demand” login. This has proved successful and we now wish to convert the configuration to be “always on” I have changed the portal configuration to “prelogon always on”, but the clients do not pick up this config change unless they manually initiate an “on-demand” connection first. Then the portal config changes get pushed to the client. What I am looking for is a way to force the client config to update to be always on without the user initiating a manual on demand connection to pull the new config. How can I achieve this? ... View more

I have an external Gateway and I wish to setup always-on except when on local LAN. As a test i am doing this on my own username but it seems to always want to connect to external GW regardless of my settings.   I have turned on Internal Host detection and this is returning "0" in the PanGPS logs so i would assume then it would realise i was internal and not try and connect me to external gateway?   Connection type is currently - prelogon always on   (T1848) 09/24/18 11:16:36:219 Debug(1712): host TEST  (T1848) 09/24/18 11:16:36:230 Debug(1729): DnsQuery returns 0 (T1848) 09/24/18 11:16:36:230 Debug(1744): Resolved X.X.X.X.IN-ADDR.ARPA for internal host detection with return value 0 (T1848) 09/24/18 11:16:36:230 Debug(1768): The host name is TEST.DOMAIN.local (T1848) 09/24/18 11:16:36:230 Debug(4040): NetworkDiscoverThread: network type is external. (T1848) 09/24/18 11:16:36:230 Debug(4109): NetworkDiscoverThread: Discover external network ... View more

So I’ve enabled SSL decryption and as expected some sites or applications fail when it’s turned on. No problem I can exclude the domain from decryption. I have a special case though, in the fact that one of these web applications is a service that my company is developing. When decryption is on it breaks screensharimg from our web application. The developers have asked me to look into this from the FW side of things to assist in them fixing it, as they would like it to work with decryption enabled. What common reasons are there for ssl decryption to break websites? What can I pull off the firewall to assist them? ... View more

What is the correct syntax to exclude a whole domain, including subdomains and pages from SSL decryption?   Say exclude all URL's from "test.com", would this suffice:   *.work.com   or would i need to include a list like:   *.work.com *.work.com/* *.www.work.com *.www.work.com/*   Thought please 🙂 ... View more

I can’t seem to get this working. I’m trying to block bbc I player but neither url filtering or APP-ID does the job. Do I need to enable ssl inspection to block https pages? I have tried with httpvshttps.com for example and I can block the http version but not the https version ... View more

I have downloaded the MIB's but cant find anything which would enable me to monitor the status of an IPSec tunnel.   Is it possible to monitor IPSec tunnel Up/Down via SNMP? ... View more