About Bittereinder

Hello there, Does anyone else have problems with response pages in IE11? They are working fine with Chrome and Firefox, but are not shown in IE11. Thanks and regards ... View more

Hello all! I have a problem with GlobalProtect. It happens that if GlobalProtect is connected to the gateway and the carrier connecton of the client goes down (3G, wi-fi, etc.) the GlobalProtect itself does not advice of the disconnection and it does not tear down the VPN, so the user must stop and start manually the connection Is there something that I am missing with the configuration? Thanks in advance ... View more

Hello!   The access to GlobalProtect is done using certificates, it works alright, users are authenticated and identified by sAMAccountName.   Sometimes happens that the firewall re-maps the already  identified user substituting the sAMAccountName with name.surname, for example. john.smith. I don't understand why.   Sometimes it works perfectly, then just moments later you connect again and this re-map happens.   Any ideas?   Thanks!         ... View more

Hello there!   I have a problem with SIP traffic for VoIP. It is a HA cluster that has experienced that problem with the SIP traffic for phone calls. For a number of hours, SIP calls could not be made or received. M ismatches with the config between active and passive firewalls were found. Could that have been the cause for the problem with SIP traffic?  Is it possible to find out why inbound and outbound SIP calls have failed for those hours? I mean, which logs should I look at?   Thanks in advance! ... View more

Hello everybody! I have an Aggregate Ethernet (AE) with a total of four interfaces to two switches through a port channel, whereby the switches are combined forming a logical switch. On the switch interfaces I see high "output discard" values, and on the Palo Alto side I see "receive errors" only in the AE interface, but no error on the physical interfaces. Is there a configuration problem? Should I add more physical interfaces to the AE? Thanks in advance ... View more

Hello everybody! Sometimes users' group memberships are not recognized by the firewall integrated user id agent. In the useridd.log we see this message: 2019-03-29 10:12:45.317 +0100 Warning: pan_user_group_user_prime_uid_lookup(pan_user_group_multi_attr.c:1314): For tierkonet\adisfo user, domain tierkonet does not exist in group-mapping It says that the domain tierkonet does not exist in the group mappi g, but it does exist, that domain was configured. Thanks in advance for any suggestion ... View more

Hello there!   How can I change the keyboard language in the Palo Alto CLI? Is it possible to access linux mode within the Palo Alto CLI?   Thanks! ... View more

Hello there! I have a problem when I try to push the commit to Panorama. This commit is added to the queue, but then nothing else happens. The odd thing is that nothing is queued in the firewall queue... Thanks in advance. ... View more

Hello all! If we put a sterling pound (£) symbol in a user password, the authentication fails. We are using GlobalProtect 4.1.8 and use a RADIUS server running Microsoft Azure MFA server on the authentication profile of the GP gateway, with just an LDAP profile on the portal. Is this related to a GlobalProtect bug? Thanks in advance! ... View more

Hello all! How must I configure the PA so that the guest users using wi-fi are redirected to the Captive Portal when accessing https without the need to install certs on the guest devices? Right now it's working for http sites, but not for https, in this case those users don't go though Captive Portal. Any suggestions? Thanks! ... View more

Hello there! I have a question regarding the encryption of a certificate. Right now I am using a certificate issued by a Class 2 Certification Authority that is using SHA-1 encryption, but this is not satisfactory. How can I update the encryption type so the certificate uses SHA256 encryption? Thanks and regards ... View more

Hello there! I have Captive Portal configured in a firewall. Unknown users are redirected when attempting an HTTP site, but those users are not redirected to the Captive Portal page when attempting to reach an HTTPS/SSL site. The Captive Portal policy has been configured properly with options with 'service-http' and 'service-https', but browsing to an HTTPS site times out / block instead of getting redirected to the Captive Portal page. Any suggestions? Thanks and regards. ... View more

Hello, everybody!   I have a problem with a URL that is being blocked despite being explicitly allowed in the white list.   I have seen the traffic logs and for that destination IP address (i.e. a website on the internet) I see that Application is "incomplete" and the Flag 0x400019. What does this flag mean? I only know the usual flags as listed in the PA website:   https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-admin/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/traffic-log-fields.html   Any suggestions? Thanks a lot. ... View more

Hi, everybody!   I have a question regarding GlobalProtect 5.0 and the error message "Assign Private IP address failed" a user is getting when trying to connect from a mobile phone (both Android and iPhone).   I tried to explain to the user that this could be caused by IP overlapping, as this link tells: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHMCA0   But he rejects that possibility and insists he has the error every time he tries (not just once in a while) and that the internal addresses he uses for VPN are only used for that.   What other things apart from IP overlapping could be causing this "Assign Private IP address failed" error?   Thanks a lot! ... View more