About OwenFuller

Interesting.  We're using a cert signed by Digicert for our portal, so I had assumed this wasn't necessary.  I may have to give it a try though.  Thanks. ... View more

Hey @ DptoInformatica, I know this is about 5 months old, but I was curious if you found a fix for this. ... View more

@Avanderheyden wrote: Well the whole idea is to keep it transparant and not have users authenticate to anything. I do suppose that if I were to use cookies it wouldn't pick up users logging in or out Yes, definitely don't want it more complicated than needing.  In my experience, it's not the connection to the portal which registers user-id, but the gateway.  If you accepted cookies for portal auth, but only accepted Kerberos SSO for the gateway, I wonder if this would still give you what you need.  Again, your deployment is a bit different than the ones I've done, so just trying to throw ideas out there. ... View more

Gotcha.  You could change the connection method to on-demand, but I'm guessing that will mess with things when the users are on network.   While I know you said you prefer not to run the portal on a public interface, I'll offer this as one option to consider.  You could configure the portal w/ a different authentication method (LDAP, local, SAML, whatever), and set a long cookie timeout (365 days for example).  This would essentially let your machines authenticate with the portal once, and be done with it for a year (or longer, if you also allow the gateway logins to generate a cookie).  If you wish, you could further secure this accdss using a certificate profile, and requiring machines to have a cert trusted by the firewall.  Then, you could run your internal gateway on an internal interface w/ the kerberos SSO authentication.  Then the machines will only attempt kerberos auth via SSO to the gateway when they detect that they are inside your corporate network using internal host detection. Sorry, I know that isn't quite what you're looking for, but I don't know of a way to suppress the notifications other than these two suggestions.  If GlobalProtect doesn't meet your needs in this area, captive portal might be a good way to capture user-id.  We do this for some of our Mac users. ... View more

Does it fit within your usage requirements to do one portal with two different gateways?  For example, if it will all be the same users, but sometimes they'll connect to Site A, and sometimes to Site B, do one portal config with both gateways listed as options for manual connection?      ... View more

I'm not quite sure on this, as I have not tried doing solely an internal gateway.  However, why not try configuring the gateway as an internal gateway, and use the internal host detection, and list no external gateways? ... View more

The GlobalProtect agent uses Internet Explorer in the background, so it should trust whatever certs are in the Trusted Root Certificate Authorities store.  Are you placing the signing certificate used on the firewall in this store?   I'm not sure as to the multiple portal configuration.  If you don't mind me asking, why are you doing two separate portals? ... View more

Is there a security policy allowing ssl and panos-global-protect from your inside zone to the zone/address of the portal? ... View more

I don't think there's a way to do an actual floating VIP on the management interfaces.  However, you can enable a management profile on another interface (such as your main inside LAN interface, or an interface you setup specifically for this purpose).  You can then use this address to login to whichever device is active. ... View more

If you are doing a source NAT with an address of  200.0.0.1, but this is not the subnet between your firewall and WAN router (R2).  How are you going to get a reply back from R2 like this? ... View more

The command show system logdb-quota should also work in Panorama.  You can also see the configured quotas in the Panorama GUI under Setup > Management > Logging and Reporting Settings > [gear icon] > Log Storage (though the GUI won't show you the number of days of retention). ... View more

Also, check the URL filtering policy that is attached to your security policy.  What are the actions for the financial-services and high-risk categories? ... View more

Well, it could be blocked of you're blocking the High Risk URL category.  However, the point I was trying to make is that if Palo has classified that site as High Risk, it's possible someone else has also classified it as a risky site.  I'm not sure whether Firefox checks any kind of list for site reputations or anything like that (I haven't used Firefox regularly in over a decade), but if it does, it could be deciding to warn you for that reason.  The warning doesn't look like a standard Palo Alto block, but rather a block in Firefox.  You really should look at your firewall logs to confirm whether that site is being blocked or allowed.  Have you checked there for a log entry?   It could be a certificate issue, as one of the other comments suggested.  If you're doing SSL decryption, I don't think Firefox honors the Windows trusted CA store.  I think you have to import the cert directly into Firefox itself.  Do you experience the same problem with other browsers? ... View more

Palo Alto classifies this URL as High Risk.  It could be that Firefox also does some checking of a list of its own, and has determined that it could be an unsafe site. https://urlfiltering.paloaltonetworks.com/query/ Category: High Risk Description: Sites that were previously confirmed to be malicious but have displayed benign activity for at least 30 days. Bulletproof ISP-hosted sites and sites with an IP address from an ASN that is known to allow malicious content. Sites that are associated with confirmed malicious activity (for example, they share the same domain). Unknown sites are considered high risk until PAN-DB completes a site analysis and categorization of the site. ... View more

Sure, I understand that will work @reaper, but that’s why I specifically said “ other than triggering a default URL block page” in my original post. I’d like to present different text and instructions for people than we do on our URL block pages (which list troubleshooting steps and a link to open a web filtering request in our ticket system).  ... View more

HTTP access seems to be working again. ... View more

I can't help much on this one, but I can confirm that I'm seeing the same thing.  Same results from a network with no Palo Alto firewall as well. ... View more

@BPry wrote: @Stevenjwilliams83, Meraki will need a static NAT statement so that it doesn't hit any sort of DIPP nat statement; you need that source port to stay the same.  I can confirm, DIPP will break your MX's connection to the portal.  As to security policies, we have one outbound rule for the meraki-cloud-controller app and another outbound rule for "any" app on UDP ports  32768-61000 in order to make our hubs work. (Your particular configuration/needs may vary from ours.) ... View more

Have you verified that the pre-logon connection is getting established by checking the Windows login screen, or the list of connected users in the portal?  I had some similar issues for awhile where the pre-logon connection was unreliable.  It ended up being caused by the authentication settings u nder  PortalName  > Agent >  Pre-LogonConfigName >  Authentication.  In my experience, if you have any of the options to save user credentials, generate cookie, or accept cookie enabled for the pre-logon user, it actually creates a lot of pre-logon connection failures. ... View more