About Abdul-Fattah

Abdul-Fattah

Hello @palomed , Expedition is the Palo Alto Migration tool, and ASA is avalable to migrate from. you can migrate objects as also cleaning the unused after. https://live.paloaltonetworks.com/t5/expedition-migration-tool/ct-p/migration_tool

Abdul-Fattah

Hi, unfortunately it is not available.

Abdul-Fattah

you will need to go to settings and sing-out

Abdul-Fattah

ping doesnt need a port, and for ms-rdp probably they are using NAT or even 3389 defined in same TCP4001. as i already mentinied that is how security policy in PA works. good luck.

Abdul-Fattah

no that will not work, because services is selected and only 4001 is allowed, when selected you will need to enter all port that you want to allow or deny that means the dns port.....

Abdul-Fattah

Application and services are handled seperatly, that means you will need to list all applications that you need, and all services that you need. an example if the traffic has been identified as Facebook:Port 80,443, then application tab should list facebook and services set to selected then services will need to list all ports that facebook will need. another exmple if the firewall identified the traffic as Unknown TCP:Port 7010, and application tab lists Unkown-tcp, but services selected and port 7010 not listed, the traffic wont match the rule. hope now it is more clear.

Abdul-Fattah

Hi @ManuShankar, you can edit the windows registry to change the default of 1 Day. but as far as i know windows handels DNS very well, and store only valid DNS, so that should not be the problem. but you will need to check this behavior further as i mentined the problem could be that the GP-users internet traffic going through the tunnel, because ive seen this before in my case the traffic was going thoruhg the tunnel to the internet which gave the users a Public ip that it can not reach the other service (in your case SFTP Public IP).

Abdul-Fattah

well that depends how you will organize your security policies, so when you search for a policy your created before it will make sense to the admin.

Abdul-Fattah

Hi @ManuShankar , if the problem with DNS, what already @SutareMayur @JoergSchuetter said, DNS Proxy can be a solution for you. but what does not make sense yet, what do you mean with enable/disable ? do they disable GP then connect to SFTP public? then re-enable VPN tunnel? because if you mean with disable/enable = re-establishing the connection SFTP should also not work. unless the windows DNS Cache is beeing fushed here. which you can also edit cache timeout to solve your problem. if that is the case that GP should be disabled first, i will asume you internet traffic for homeoffice users go through the tunnel, right? the behavoir you discribed could be linked that they are going throguh the tunnel to reach your SFTP Public-ip, and when they disconnect the use the private Internet.

Abdul-Fattah

Hi @PA200-1, you can add up to 5 portal addresses check this, Step 2 and Step 3 are what you need: https://docs.paloaltonetworks.com/globalprotect/10-0/globalprotect-admin/globalprotect-apps/deploy-app-settings-transparently/deploy-app-settings-to-windows-endpoints/deploy-connect-before-logon-settings-in-the-windows-registry.html

Abdul-Fattah

Hi @PA200-1 , You will find the portal settings in Windows Registry, go to: HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup\. or the user will have to enter the new portal ip addresses manually and then choose where to connect.

Abdul-Fattah

Hi @Patrick_Jessett, more info will be needed, what guide you used to Configure Pre-Logon?

Abdul-Fattah

Hi @KrishnanR, you will need to add all ports that the applications will use because in the services tab "Selected" will be set. each application will use the ports it needed, DNS works on normally on Port 53, so it will use this port.

Abdul-Fattah

Hi, Unfortunately, you can not make the firewall send a rst, the Firewall only send RST when a threat is detected.

Abdul-Fattah

Hi, 1- You can add the application and all ports to same rule, as the application wont be identified based on the port it uses but here you will have to allow all services like also 53, 143... 2- you can choose the application and set service to any, that should work but not best practice.

Abdul-Fattah

@c.keller if you set the ID to none by default the firewall will use the IP, so make sure that the customer side Peer-ID and your Local-ID match. if the problem with the Identification you will recieve a notification in the logs. what system logs is your firewall reporting regarding the IPsec? is the firewall receiving or trying to make a connection to the other end?, check sessions and traffic logs.

Abdul-Fattah

Hi, To achieve what you want. You will need to create policy based forwarding for outgoing traffic and enable “symmetric Routing”. The back traffic the will be recognized automatically.

Abdul-Fattah

Hi, sincei port forwarding enabled, local IP would be the firewall ip local id is same as what you set on the other side as peer id. Your Peer-id set it to customer public ip, NAT traversal is also not needed, Try to turn off the firewall on your Fritzbox. If that didn’t help, turn on ike passive mode on your firewall and make the other side initiate the connection.

Abdul-Fattah

Hi, yes it’s doable, create on the portal a new client authentication with OS as “browser” and set allow authentication with user credentials or client certificate to “Yes”. and put this authentication on first position in Client authentication. Hope this helps Good luck.

Abdul-Fattah

@AlexanderAstardzhiev you can leverage "authentication-sequence" and select multiple authentication types/profiles (LDAP,Radius,Local..) and use it for Portals and Gatways.

Abdul-Fattah

two domains resolving to same IP, for palo alto you are using only one IP. the Firewall does not care about Public-domains. as i mentioned earlier : " another soultion would be same gateway, seperation based on users , and you can also define different IP pool for these non-corporate users and the networks that should they access with split-tunneling and add/edit your security policies as needed ." and for portal you change nothing. Good Luck.

Abdul-Fattah

then what you need is 2 external gateways, two tunnels, two public Ips. another soultion would be same gateway, seperation based on users , and you can also define different IP pool for these non-corporate users and the networks that should they access with split-tunneling and add/edit your security policies as needed .

Abdul-Fattah

Hi, you can achive this with configuring an Internal Gateway and an external Gateway and one or two portal, the Internal Gateway is an interface on your internal Network, External Gateway accessed from Outside normally out from internet (Public-IP) - Tunnel interface required here. for more information check these out https://docs.paloaltonetworks.com/globalprotect/8-1/globalprotect-admin/globalprotect-quick-configs/mixed-internal-and-external-gateway-configuration https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClH1CAK

Abdul-Fattah

Hi, maybe this info will be helpful for your troubleshooting: a " nego-fail" event will not be generated if the Interface is down. what could make LACP flip up and down like this, is that your Firewall LACP configuration uses Fast Transmission Rate. try using "Slow" Transmission. you can check LACP logs on firewall which are logged during these events in l2ctrld.log, these would be helpful less mp-log l2ctrld.log

Abdul-Fattah

you can use an external services that provides such as Spamhaus...etc or you can also create your own list.

Abdul-Fattah

that works on lower models, like PA-800,3000 not sure about PA-5000 QoS will be applied on egress phy-interfaces/AE1 only, but for granular treatment on clear text traffic ,you can use a QoS Profile for traffic originated from a sub-interface.

Abdul-Fattah

you can specify which sub-interfaces you want to apply QoS on, under "source Interface" in "Clear Text Traffic" with the appropriate profile.

Abdul-Fattah

Hi @marianaduran , before reinstalling GP you will need to close those Process on windows: P-ID: 72028 and 5224. if you already did that, simplest solution install a newer version of GP.

Abdul-Fattah

@Mostafa-Elmokadem Can you share why you would need BPF if you can simply add a route to the server in VR? Spoof IP: if source interface and routing interface in the same zone. Strict IP: if source interface and routing interface exactly the same. Spoof IP is for internal Zone only.

Abdul-Fattah

ingress interface when traffic enters the Firewall, when client send to firewall that is an ingress interface, when a server send to firewall that is an ingress interface. Strict IP is a security feature, but in your case "in your Environment" you can not use it. because after using BPF obviously one these two conditions not filfilled. so you will need to investigate the matter further. and make some changes in your network. or simply disabling it.

Date Registered	‎01-05-2020 09:32 AM
Date Last Visited	2 hours ago
Total Messages Posted	69
Total Likes Received	11

Online Status	Online
Date Last Visited	2 hours ago

Strata

Prisma

Cortex

About Abdul-Fattah