Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- 5G
- IoT Security
- Prisma SD-WAN
Network Security
- Prisma Access
- Prisma SaaS
- Prisma Cloud
- CN-Series
- VM-Series:
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
Security Operations
- Resources
- COVID-19 Response Center
- LIVEcommunity
- ›
- About bgmncwj
About bgmncwj
Announcements
Changes to the LIVEcommunity experience are coming soon... Here's what you need to know.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
2 weeks ago
21Posts
7Likes
1Solution
Apr 02, 2021Last Visited
User
Activity
User
Profile
Latest posts by bgmncwj
| Subject | Views | Posted |
|---|---|---|
| 1072 | 05-03-2017 12:06 PM | |
| 1087 | 05-02-2017 09:25 AM | |
| 227 | 05-02-2017 09:13 AM | |
| 680 | 12-30-2016 11:19 AM | |
| 468 | 10-28-2016 08:54 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 | 10-28-2016 08:54 AM | |
| 2 | 09-13-2016 06:11 AM | |
| 2 | 12-07-2015 11:02 AM | |
| 1 | 12-07-2015 10:52 AM | |
| 1 | 09-21-2015 11:15 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 6 | |||
| 1 | |||
| 2 | |||
| 1 |
User Badges
Public Statistics
| Date Registered | 12-19-2014 06:09 AM |
| Date Last Visited | 2 weeks ago |
| Total Messages Posted | 23 |
| Total Likes Received | 7 |
05-03-2017
12:06 PM
No problem, thanks for replying. I was afraid of that. I even checked with my SE right after 8.0 was released and he assured me that I would in fact not need that license to enable IPv6 for remote access. Oh well, time to see what that'll run us.
... View more
05-02-2017
09:25 AM
What was the license issue? I'm hoping to use IPv6 over GlobalProtect soon and am just licensed for Support, URL, Threat prevention and Wildfire.
... View more
05-02-2017
09:13 AM
Has anybody been successful in getting MP-BGP up and running over IPv6? Currently whenever we try to enable it to add v6 routes from AS7018 the commit fails and leaves the routed daemon on the dataplane in such a state that the only way to fix it is to reboot the 3060. Thankfully it continues to pass traffic and we're running in Active/Passive but it still seems like that pretty catastrophic. We've only tested this on 8.0.2 (upgraded from 7.1.9). If you do have it running, mind sharing how you have it configured? I've got a support case open now (660333) but so far they've just been able to confirm the settings look correct.
... View more
12-30-2016
11:19 AM
We have an internet facing SFTP server for our customers to use and I wanted to enable SSH decryption to see into that traffic and potentially auto-block IPs trying to bruteforce their way in. However whenever I enable SSH decryption the SFTP session connects fine but after 128k uploaded it just stalls out. Is that expected behavior? I've tried to add ssh-tunnel to the security policy but that didn't make much of a difference.
... View more
10-28-2016
08:54 AM
1 Kudo
We recently had a case where we were seeing high proxy_wait_pkt_drop and SSL decryption sessions were taking a while to connect. After a week or two of back and forth support advised us to disable Certificate Revocation Checking (both CRL and OCSP) under decryption settings and that appears to have fixed the issue. Support also mentioned that those settings were just checking the revocation status of our ssl-forward-trust cert and doing us no good anyway and the box independatly pulled CRLs. That doesn't sound right to me, is that correct? And if so how do we block sites with revoked certs, https://revoked.badssl.com/ now seems to be signed by our ssl-forward-trust cert with no issue. How can we prevent signing revoked certificates?
... View more
09-13-2016
06:11 AM
2 Kudos
We've been using Duo two factor along with requiring client certs on machines with a lot of success. This allows us to use two factor and ensure that we only have company approved equipment connect to the VPN. We have the gateway set to use the Duo radius server (https://duo.com/docs/authproxy_reference) for authentication, which then verifes against AD and sends a push request to the users device to confirm authentication along with having a certificate profile setup to verify that a company issued AD cert is installed. On the portal side we just have it verifying against AD directly with no certificate profile. That seems to be the best blend so users don't get requested to authenticate with two factor for config updates, just to actually log in.
... View more
02-05-2016
06:05 PM
Hmm, that's no good. I was hoping it fell under IPSec VPN but I guess that was optimistic.
... View more
02-05-2016
10:36 AM
So we're rolling out IPv6 to our network, one thought that just crossed my mind is what kind/if any support for IPv6 does GlobalProtect have?
An issue I see is when we start listed AAAA records for internal servers in DNS, external VPN users will get those responses and will try to access those directly (and be denied) unless I can route them over the tunnel.
I currently get an error adding a IPv6 range to the gateway config thought I can add an access route to the config for an IPv6 block but after some brief testing it doesn't make it to the client.
Any thoughts?
... View more
01-05-2016
06:08 AM
I upgraded on Sunday afternoon and so far so good.
... View more
12-22-2015
09:12 AM
It looks like there were quite a few fixes to SSL decryption in this release. I'm hopeful this is actually the release where it's been fixed.
... View more
12-07-2015
11:02 AM
2 Kudos
For reference here's the work-around I was provided:
set profiles dos-protection profiledos type aggregate flood tcp-syn enable yes syn-cookies activate-rate 0 alarm-rate 1000000 maximal-rate 1000000 block duration 100 set rulebase dos rules dosrule2 service service-https source 192.168.1.10 destination 1.1.1.2 action protect set rulebase dos rules dosrule2 from zone L3-Trust set rulebase dos rules dosrule2 to zone L3-Untrust set rulebase dos rules dosrule2 protection aggregate profile profiledos
Everybody running into this problem should still open a case though to show how many people are being affected.
... View more
12-07-2015
10:52 AM
1 Kudo
There really isn't (from what I've been told and discovered after implementing the work-around). They're recommending people configure some DoS rules against SSL. This will extend the interval between the issue happening and traffic halting but not fix it.
... View more
11-16-2015
05:12 AM
Is anybody running 6.1.x having this problem? I hadn't heard of it occuring in the 6.x line until the PA response stating it'll be fixed in 6.1.8. I'm concerned that once again they've missed the root cause.
... View more
11-13-2015
12:05 PM
I wonder how big a problem has to be before they patch it out of the normal release cycle?
... View more
11-13-2015
06:40 AM
So far my case (381368) is still in ' Engineering Escalation ' and was last touched on 11/5. I haven't heard anything about a expected resolution date or release.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
2 weeks ago
|
Latest Tags
No tags yet
Latest Blogs
Latest Posts
Copyright 2007 - 2021 - Palo Alto Networks
