About kamish

I don't quite understand why it is awful?  We have been using it for over a year and after everything was configured properly it works flawlessly!  I love how when products don't work exactly how someone envisions them to that they are immediately awful.  PA tech support was great when we needed help setting up GP. ... View more

Roger.  We use Win7 but a custom image.  We haven't had any issues with the new client 1.1.2-9 and OS 4.1.2.  Have been using GP since 1.0.1 and 3.1.1 and upgraded along the way.  Granted it took about 8 months to get everything working right, but everntually everything clicked and works great now.  I just wish that there was more support for GP via documentation.  However, support was helpful along the way and my sales engineer is awesome! ... View more

This is an interesting thread.  I have been using GP since the original release.  I agree that the guide is very vague and doesn't help much. Attached are screen shots of my config with OS 4.1.2 and GP client 1.1.2-9 and all works well.  We use a root CA and sign all of the server and client certs with the CA. Hope this helps. ... View more

I beleive that this is a bug.  We are also running 4.1.2 and I cannot set any OUs in our authentication profile either!  Please update when you get your case resolved. Thanks!! ... View more

Looking at your log....you are having an authentication issue.  The gateway is not allowing the credentials to be passed which leads me to believe that you pan agent is not configured properly or LDAP is wrong in the LDAP profile for your normal (non-admin) users. ... View more

Unfortunately GP is a reltatively new technolgy and many customers are having trouble with it.  It took us about 8 months to get it working right in our environment. Is the admin login that you can connect with on the local user database on the PA?  or is it authenticated via LDAP and AD? Are you running a user identification agent?  I believe that GP requires one.  This is one thing that is left out in the configuration guides.  Also, in your Authentication Profile for your normal users set to "allow all" and retest.  Also ensure that your LDAP is configured properly. ... View more

What version of GP are you using?  And have you configured the Portal to allow for an override shut down? ... View more

One other thing to check...Have you checked that your panuid client is working properly? ... View more

We have has GlobalProtect installed and working for nearly a year.  As soon as we upgraded to 4.1.2 software and 1.1.1 GP client, it stopped working externally.  When trying to connect it just gets hung up on "Connecting" and never get through to the Portal to authenticate.  Reverted software to 4.0.5 and GP client to 1.0.5 and everything works as it should. ... View more

We had this same issue.  We are staying away from 4.1.1 and 4.1.2 until further bugs get cleaned up.  Also, when we upgraded to 1.1.1 GlobalProtect client and software 4.1.2, GlobalProtect would get caught up "Connecting" and would not connect.  We have reverted to 4.0.5 and 1.0.5 and everything works the way that it should. ... View more

You are not the only one having this issue. We have a couple PA-500s in our environment and upon upgrading to 4.1.2 from 4.0.5 Apps-and-Threats 288-1251 would fail to install and sync to the HA Peer.  We also upgraded our GlobalProtect Client to version 1.1.1 from 1.0.5 and GlobalProtect stopped working externally.  It would get hung up on "Connecting" and fail to connect.  Upon testing, we reverted to our previously installed versions of GlobalProtect and Software and GlobalProtect then works.  However, the "panupv2-all-contents-288-1251.tgz" still will not install properly and sync to the HA Peer. Staying in our known working config until this gets fixed... ... View more

We have a couple PA-500s in our environment and upon upgrading to 4.1.2 from 4.0.5 Apps-and-Threats 288-1251 would fail to install and sync to the HA Peer.  We also upgraded our GlobalProtect Client to version 1.1.1 from 1.0.5 and GlobalProtect stopped working externally.  It would get hung up on "Connecting" and fail to connect.  Upon testing, we reverted to our previously installed versions of GlobalProtect and Software and GlobalProtect then works.  However, the "panupv2-all-contents-288-1251.tgz" still will not install properly and sync to the HA Peer. Staying in our known working config until this gets fixed... ... View more

I have done extensive setup and testing for GP in my environment.  I have answered your questions below, per my experience and testing. 1. If I configured Global  Protection for external users, is it possible to block for network  access for specific user who doesn't has latest patch or latest  anti-virus? -Yes.  I just want to clarify though, when you say 'external users' do u mean members of your domain but connecting externally?  If yes, then create a HIP Profile with objects defined with the match that you want.  You then need to apply that HIP profile to a security policy to 'deny' access to http and https, if you want to block them from surfing. Creating the HIP is tricky though for a Deny Policy, make sure that you configure it the way you want it to be configed.  I.E. the Virus definition timeframe. I would suggest configuring the product version rather than the virus definition timeframe, this provides a little more of a solid check. 2. if it is possible, can i configure redirection to warning msg for those specific user? - Kind of.  If you have a user that receives a HIP message stating that they are not compliant, you can have the message say anything you want.  For instance, if I have a user in my environment that is not compliant, the message says "Your client is not compliant because "enter reason here".  Please contect your systems administrator for assistance."  This will allow you to know what is wrong and why they are not able to connect to resources.  But test to ensure that the HIP is setup exactly how you want to save headache from people calling you all the time to fix it.  Furthermore, there needs to be a deny rule in place to not allow them access to resources if they are not compliant.  For instance: In my environment...currently we only want clients that are part of our domain to have access to resources whether they access through the internal or external gateway.  This is so any Joe Schmo laptop cannot come inside and access our network.  Or if a client that is not part of our domain tries to access through the external gateway they are denied access to everything.  So we have a HIP profile in place that checks if they are or are not part of our domain.  If they are part, they are 'allowed' access, if they are not part of our domain they are 'denied'.  When the deny rule is matched, the client cannot surf the internet or have access to internal resources.  3. Does global protection must connect with SSL VPN?? Is it impossible without SS LVPN Connection? -Yes.  Absolutlely!  We run GP all the time with single sign on without VPN.  4. if it is possible to apply global protection without SSL VPN, I’d like to apply to internal users of firewall. -Yes.  We do this also.  You just have to configure an internal gateway and an external gateway.  Keep in mind that GP will always try to connect to the internal gateway first after it authenticates through the portal.  But, in my opinion, best practice to to just configure 2 serperate gateways...internal and external.  Make sure that the internal gateway has an internal IP address. 5.  If I configured Global Protection, is it able to apply for internal  users of firewall (paloalto L3 mode) without SSL VPN Connection? -Yes. See answer to #4. Side notes.  Make sure that you test all angles of global protect before implementing.  It works great once everything is configured properly.  And in my testing and config, it takes some time to learn everything that needs to be done to ensure that it works right. ... View more

While the Global Protect config guide will help you with your initial setup, it will not be your final solution.  There are many things that are missing in the guide. ... View more

- Application 'outlook-web' requires 'ssl' allowed in the policy - In your policy In services allow tcp-443 - Application 'outlook-web' requires 'web-browsing' allowed in the policy - In your policy In services allow tcp-80. See if this helps. ... View more