About Mariusz.pianka

Well, The ISP of the end user is UPC and the IPv6 is provided by the ISP to the ISP provided router. test ipv6 results:   http://test-ipv6.com/?ip4=37.228.241.77&ip6=2a02:8084:2a60:2000:b02a:14aa:8800:3ca0&a=ok,3438&aaaa=ok,557&ds=ok,765&ipv4=ok,338&ipv6=ok,389&v6mtu=ok,1671&v6ns=timeout,10958&dsmtu=ok,404&failed_sites=7f24       ISP gives out only IPv6 or IPv6 and IPv4 both? Both I guess.   Can user uncheck "IPv6 checkbox" under adapter settings and try then? Same result,    IPv6 is disabled on PA, we haven't enabled it.  What IP address would i give it to the interface?  I'd say I'd have to obtain one from ISP before I could enable it on the PA right ?  ... View more

Hi Guys, I wanted to continue to on this thread as it's somewhat related.    We have PA-3020 running PAN-ON 6.1.10 We have encountered problems with our staff member who is unable to connect to our Global Protect portal. Up on investigation we found that the ISP issues IPv6 address(!)  When the individual goes to "whats my ip" in google, the IP address that shows up is a long IPv6 address and the ISP shows as "Google"    However, when he goes to other website, http://www.whatsmyip.org/ that shows IPv4  We had a look at our logs, and we can see connection attempts from IPv4 provided. There is nothing out of ordinary, there are even packets exchanged. However the user is unable to connect.    We asked him to create an AP from his phone and connect this way and that worked. Can somebody elaborate on the issues we are experiencing?  If I were to go to the ISP what should I tell them ? So far, according to them everything works...   Any thoughts?   Thanks Mariusz ... View more

Hi Guys, I'm trying to create the pattern to reset the connection if the connection comes from Internet Explorer. I took PCAP with wireshark and user-agent shows as : "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" (there is \r\n at the end but I think its wireshark? ) Nevertheless I copied my text to RegExr; and did my regular expression to match. .*Mozilla\/5\.0\s\(Windows\sNT\s6\.1\;\sWOW64\;\sTrident\/7\.0\;\srv\:11\.0\)\slike\sGecko it highlights the text, meaning It is a valid expression, Palo Alto takes it, and while I was troubleshooting I even got some hits but internet explorer works as normal. Can you tell if this is even possible? ... View more

THANK YOU SO MUCH ! It was not obvious to me AT ALL. If you buy a certificate and you don't want any errors and have the Portal and Gateway fully certified by the external CA it simply won't work! I just spent exactly 2h and 28 minutes figuring out why the heck I continue to receive "Server certificate verification failed" error. I even posted some screenshots here for help. Then, I got to your post, changed the "ADDRESS" field which obviously is NOT address but FQDN and I'm in. No Error, all connected just fine. You should get like 5 starts for this hint. Thanks a lot Manilla. BR Mariusz ... View more

Hi there, I'm getting the same error with GP 2.1 on Windows 8.1 , actually I always have big trouble with windows machines. it works perfect on Android, Apple, but Windows takes me hours and not working every time. I do huge hit and miss config every time. Can somebody explain how to configure this please? I bought the domain. I generated new CSR and signed it by the Trusted CA (VeriSign) I imported the cert and I see the certs "merged" and have the FQDN name of a cert with "private key" I select the cert for Server Cert I connect to the gateway and get the same error as everybody in this post. Can not select continue. I use FQDN for Cert name, Portal address, and in GP client to connect. Do I still need to export the cert and import to the windows client root folder? if so , why ? ... View more

Thank You for your prompt reply Greg, I found this easy by "ssl decrypt wireshark " and thought to keep it that way I went a bit further ahead and placed the certificate into Wireshark capture. I found interesting entries: dissect_ssl3_hnd_srv_hello found CIPHER 0x0035 -> state 0x16 dissect_ssl3_hnd_srv_hello trying to generate keys ssl_generate_keyring_material not enough data to generate key (0x16 required 0x37 or 0x57) According to some posts in other forums, Wireshark throws that error when it doesn't have a full SSL Handshake, but only short SSL handshakes (resumed SSL sessions). Indeed my capture was taken from resumed session, I already had website open. I was thinking to do the full capture again, start fresh but your post made me thinking again. You are saying that the Private Key is generated on the fly on Palo Alto so It's impossible to capture decrypted traffic into PCAP files for analysis ? How can Palo Alto build custom apps then ? Surly, they are not being given Server Certificates of the companies they are making signatures for ? ... View more

I would like to ask some more questions on this. We are decrypting traffic towards one of the websites. The decryption is successful and we see that application is now web-browsing and not SSL. I want to create a custom application for certain part of this site. While taking the packet capture on Palo Alto I have to specify the following: debug dataplane packet-diag set capture stage (drop,firewall,receive,transmit) , so I ended up with 4 .PCAP files. All traffic appears encrypted in Wireshark. I extracted Private Key from the certificate and tried to apply it to Wireshark but wireshark doesn't decrypt anything in any of the 4 files. My question is if I have to have all traffic in one log file (one pcap) in order to decrypt it in wireshark ? Have anybody been successful taking packet capture from Palo Alto and decrypting it in Wireshark after ? Traffic detected in PCAP show as TLSv1 for the interesting traffic. Any thoughts of advice? Thank You in advance! Regards, Mariusz ... View more