About GeorgiosFakis

GeorgiosFakis

Hi , Check the user-id how is formatted in the logs like : domain\bob Then check the traffic logs that you interested and check there the user , it should be something else and that is the reason why Then check the security policy to see if you have domain\bob like the user ID . The HIP collection is taking the username and domain.

GeorgiosFakis

Hi , We found around 100 users having this issue where mapped drives had their COMPUTER name like alias and linked to one of the servers for personal host space . Basically , helpdesk instructed them how to change that so the mapped drive have a normal path . I don't know how it was working before with Juniper Pulse but with GP we had issues. All the other mapped drives that was from the AD policy were ok after connecting to GP .

GeorgiosFakis · ‎03-09-2020

Hi, We tried with one user and didn't work but you know what they say? Pulse Secure was not causing that issues . I have isolated the issue to specific shared folders. All common shared folders they are connected after user connect to global protect.I have asked the server team to check as well these specific shared folders and from what it seems is the sync between host and AD.

GeorgiosFakis · ‎02-27-2020

Check for MTU issues like counters with MTU exceeded .We have set it up to 1427.

GeorgiosFakis · ‎02-26-2020

Hi , Users most of them have Windows 10 and they show disconnected .We have not tried to restart this service but what we have tried to access through run command \\shareX\ . We don't have standard mapped drives, each user adds their own for their work.

GeorgiosFakis · ‎02-26-2020

Hello all , Having issues with some users where they have mapped drives but after they connect to global protect they don't work. If they unmap and they map again it works . When doesn't work after connecting to globalprotect if they ping the IP of the server that they have the mapped drive it works but SMB it doesn't . We have on-demand globalprotect, SSO disabled of course and we allow netbios, SMB and I don't see any blocked traffic. I have tried to search that and I don't want to say to the customer to fix that with scripts net use because all users are using their own shared folders.

GeorgiosFakis · ‎02-26-2020

Forgot to update We fixed that with disabling the timeout of the user-id but we also upgrade the agents to 5.0.8.

GeorgiosFakis · ‎12-07-2019

Palo Alto engineer and myself we were looking the logs . User connected in the morning , opened a UDP session with significant amount of data transimtted and recevied .Was allowed by an ACL in line 35 let's say and after 3 hours Deny ALL acl was matching in line 50 . We see that HIP report was sent and there flags 0x63 & 0x61 on the allowed and deny from the log .We suspect that is related to HIP report .We see that was sent every hour and HIP log is matching the HIP profile every hour .Question is why traffic that elapsed time was 3 hours is mathcing after that time DENY ALL ACL.

GeorgiosFakis · ‎12-06-2019

PA released version 5.0.6 that fix some HIP issues. Now for the case I have they are still reviewing the files I sent them . From what I see is that : (T20032) 11/28/19 11:18:03:568 Debug(4477): Send hip report check failed I have increased the timeout to 1 day for the HIP report from 3 hours that was set.I will keep you posted .

GeorgiosFakis · ‎12-05-2019

Hi I have done this but again user reported that next day . I got debugging logs from user and I see it's an issue on HIP report that timed out . I have opened a case with Palo Alto and waiting their availability to check it .

GeorgiosFakis · ‎11-28-2019

Is set to 45 minutes :

GeorgiosFakis · ‎11-28-2019

It's not sure how many experience the issue but right now i have reports from 20 users . During the pilot phase was reported by 2 only but I had 20-22 pilots and most of them are not using the global protect all day , so it's not clear since the users are not connected the whole day on the global protect. The reports I get about the issue is from users that are connected 8-10 hours constantly .

GeorgiosFakis · ‎11-27-2019

I can see that today but issue started before 10:13 . 10:13 was reported that was ok and user connected 7am which I don't have logs before that for user-id which is strange.

GeorgiosFakis · ‎11-27-2019

We had some issues 2 months ago with the Pilot where user let's say George had another account like adminGeorge and group was different so we removed the user/group access filtering in policy . Now we have Source IP pool that we provide and the Zone of Global Protect only . Destination is any any to internal resource for that user had issues today and with AV,VULN,ANTI-SPY profile . Nothing was blocked because of the profiles .

GeorgiosFakis · ‎11-27-2019

I have global protect v5.0.5 deployed to all Corporate Windows and some users reported that when they work everything stop to work and suddenly after 5-10 minutes is back again without disconnecting them from the global protect .This happen random times and not always .I have a user though that he reports that every day for the last week . Palo Alto version is 8.1.11 VM-300 and GP agent 5.0.5 on a Windows 10. I can see from the logs user is working fine in one server , then traffic getting blocked and can see only traffic log but not threat etc. I am allowing based on the IP and the Zone and destination is any app any service . HIP looks fine and agent is sending the report every hour . Today this happened to a user connected 7 am and stopped working around 10am for 5 minutes .In the logs I can see HIP reports were send before and after the incident and user-id was reported that was learned from the AD . I can see from the logs if that is helping that user is not written and after working is written . Is that related to USER-ID where I need to exclude the IP pools from the GP on the USER-ID ?

GeorgiosFakis · ‎10-21-2019

Hello again , We found 1st that access to google is using com.android.vending URL. We found also out today that google is using NON google IP segments to host their applications. We had the situation that we were no able to download any application and we were seeing Waiting for download ....Then with NETSTAT APP I saw that Download Manager has sent SYN but not reply because I was blocking .Then I allowed and it worked . Now , the questions is what are these ranges for content download from Global protect per region .

GeorgiosFakis · ‎10-18-2019

I have the same issue when doing full tunnel or split tunnel by define all google networks . Users cannot access google play but all other google applications are working perfect . I see that in the mobile logs : (11200)10/18 08:16:04:508918 - PanVPNService: black/white app list is empty and no default access route, add play store app to blacklist (11200)10/18 08:16:04:509337 - addDisallowedApplication, appName=com.android.vending (11200)10/18 08:16:04:509681 - SetVNICConfig return true (11200)10/18 08:16:04:550990 - startVirtualInterface success (11200)10/18 08:16:04:551061 - detach the fd and send it to native code, fd=102

GeorgiosFakis · ‎09-22-2019

No , because user should put one time user/pass that will be checked against AD and then on the gateway I would like user to put one time password through another AD that delivers the SMS to user . I made it work with Portal SMS and gateway AD credentials but I get 3 times to provide password and two of them is AD credentials .

GeorgiosFakis · ‎09-21-2019

I had save user name only and I tried also with no.

GeorgiosFakis · ‎09-20-2019

I have multiple gateways and that means that Firewalls that have the portals they don't have the gateways and the firewalls with the gateways they don't have any portals . I tried to attach LDAP-AD profile that works in the portal and the profile for the SMS provider to the gateways which I have configured the firewalls to send vs source-ip only. But doesn't work because it seems that app sends the ad password as passcode since I get SMS that my account is locked but if I do the opposite and I use the SMS auth in the Portal and the LDAP-AP profile in the gateway then I get SMS , I put that since I am getting prompted and then auth fail with no reason but I suspect that this SMS passcode is being used in the gateway .

GeorgiosFakis · ‎09-20-2019

Can I have LDAP profile to authenticate users against AD for the portal and then use authentication profile with RADIUS for SMS token delivery for the gateway ?

GeorgiosFakis · ‎09-16-2019

Hi , Is there anywhere that I can restrict that client vpn user "BOB "using the global protect that can connect only once and not many times the same time from different systems like I have users connecting from the mobiles , tablet and computer the same time ? I would like to have that user can connect 2 times the same time from different devices.

GeorgiosFakis · ‎09-16-2019

It seems that cannot find a server in auth GP-VPN-AUTH so go there to see what you have stated and then go to server profile to see if the profile has any IP .

GeorgiosFakis · ‎09-07-2019

thank you , so if I want to have the 2nd factor authentication like mentioned how is going to be configured ? 2 auth profiles in one auth sequence attached to both portal and gateway ?

GeorgiosFakis · ‎09-06-2019

Hi all , Has anyone accomplished to authenticate external users 1st with AD through LDAP profile and then SMS through radius to another server ? I guess 1st authentication will done in the portal and SMS auth profile can be added on the gateway ?

GeorgiosFakis · ‎09-06-2019

Hi all , I am running PAN OS 8.0.19 and GP 4.1.12 and users cannot access google play store while they are connected to the VPN from androids . I have tried with spli tunneling including 63 subnets from google and I have tried full tunnel defining in the ACLs IP any any just for tshoot but it seems I am getting in but cannot download any app . I have originally allowed users to access google in China from mobiles and filter traffic based on google APPs, URLs and IPs . Has anybody seen that issue ?

GeorgiosFakis · ‎09-04-2019

Because I have 32 set of AD groups that they have different split tunnel networks

GeorgiosFakis · ‎09-03-2019

Each group different split tunnel .I think is one way to go to version 9 .

GeorgiosFakis · ‎09-03-2019

I agree , but I have 32 groups that need split tunneling and I have 9 gateways so it means 9x32=288 subnets

GeorgiosFakis · ‎09-02-2019

Yes, that's true , in PAN-OS 8.1 you can do that but in 8.0 you cannot .Looking for a solution on 8.0 before I go to 8.1 next year.

Date Registered	‎02-05-2019 07:25 AM
Date Last Visited	14 hours ago
Total Messages Posted	34
Total Likes Received	2

Online Status	Offline
Date Last Visited	14 hours ago

Strata

Prisma

Cortex

About GeorgiosFakis