About jcostello

Kevin How about swapping the authentication profile for the Portal and the Gateway - RADIUS authentication on Portal and LDAP on the Gateway. RADIUS will push the user1@domain.com to the gateway and then prompt. Not the typical configuration but will still do two factor authentication. ... View more

What type of firewall is the peer device? The message above is indicating that the IPSec settings are not matching on the firewalls. What is the IPSec profile you are using on your local systems and what is the configuration of the remote host? ... View more

This article is based on setting up Freeradius to use Google Authenticator - http://www.virtualvcp.com/tech-guides/36-vmware-view/194-securing-vmware-view-google-authenticator-and-freeradius I have not done this as yet but as it is using RADIUS as the authentication method, it should work. ... View more

Slawek, You might start by looking at the netstat output for the workstation with the source port 65409 This article will help for a Windows system - See what process is using a TCP port in Windows Server 2008 - TechRepublic The SysInternals tools from Microsoft can also help - Windows Sysinternals: Documentation, downloads and additional resources One issue that may arise is that modern malware tends to hide itself from the built in tools that could be used to identify it. May your efforts be successful. James ... View more

Another option is to run request system private-data-reset from the CLI This will clear the configuration from the device but maintain the software version and dynamic updates/ ... View more

That still requires a commit on the Palo Alto to disable the account ... View more

Meant to include the link to this article in my prior response Using LDAP to Authenticate to the WebUI RADIUS can also be used for WebUI authentication Configuring Read-only Admin Access with RADIUS Running on Win2008 and Cisco ACS 5.2 Configuring Administrator Authentication with Windows 2008 RADIUS Server (NPS/IAS) How to define Access Domains for Administrators ... View more

A couple of options as its not possible to disable an account on the PA itself Change the password on the account after the consultants leave Configure either Kerberos or LDAP authentication for the account and disable the account there I typically recommend number two since it does not require a commit on the firewall to change the password. ... View more

are you in configure mode? ... View more

Try something along the lines of show service | match 1492 tab complete will also work to show you the remaining available command strings show service {hit the tab key on your keyboard}   <name>   <name>   |        Pipe through a command   <Enter>  Finish input ... View more

try just show network ike crypto-profiles ... View more

can you grab and clean up (replace any public IPs with something else i.e replace the Cisco address with Cisco-Address) the following from the 3020 show network tunnel ipsec (only need the lines for the tunnel having issues) show network ike crypto-profiles ike-crypto-profiles show network ike gateway (only need the gateway associated with this connection) From the ASA - connect to ssh or console show run find the related Cisco command from this article - Sample IPSec Tunnel Configuration - Palo Alto Networks Firewall to Cisco ASA for the VPN ... View more

On the ASA CLI or the configuration output I was looking for the assigned transform set Which of the crypto profiles on the 3020 is assigned to the VPN that is having issues ... View more

From the 3020 CLI - please provide the output for your profile configured for IPSEC set cli config-output-format set configure show network ike crypto-profiles ipsec-crypto-profiles from the ASA gather the line that starts with crypto ipsec transform-set that is configured for the crypto map Thanks ... View more

IPSEC Crypto Profile on PA defaults to group-2 (group 1, group-2, group-5 and group-14 are available) The ASA is indicating group 1 ... View more