About trivers01

Hey @RyanBF,   As the Arch distro isn't listed in the compatible versions list, we can't confirm full functionality of the GlobalProtect App.   I've included a link below that lists all compatible versions for each specific App release:   https://docs.paloaltonetworks.com/compatibility-matrix/globalprotect/where-can-i-install-the-globalprotect-app#id7a3c3401-b233-43b0-8d78-dfceab88798f_idbcd7ccf7-eceb-462c-8678-1a5fa51cbc18     ... View more

Hey @Martin_Chung,   Prior to the new reporting feature for GlobalProtect introduced in 9.1, the only method of retrieving reports would be manually querying the data you want via the system logs and exporting them.   I've included a document below that may discuss this in more detail for you.   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClplCAC ... View more

Hey @fatboy1607 ,   One of the biggest issues involving Pre-Logon tends to be related to the certificate deployment process.   We must ensure the client certificates being deployed are stored in the correct directories and signed by the same root CA which signed the server certificate(s) being used for the Portal and/or Gateway.   I've included a document below discussing this in more detail for you to review as well: https://knowledgebase.paloaltonetworks.com/kCSArticleDetail?id=kA10g000000PPfM   Also, if the configurations for the "pre-logon" and "any" users are the same, you won't need to specify a separate configuration for the pre-logon user as this will be matched by the "any" user!         ... View more

hey @FDEMUYTER    I know it's been a while since you'v made this post, but I hope this message finds you well.   Based on the PanGPS logs you've previously posted, the Agent is unable to verify the server certificate used for the Gateway SSL/TLS profile.    Common issues for this would include CN mismatch, as mentioned before by other community members, and incorrect certificate deployment: eg the Agent is unable to follow the full chain. A quick way to test this is using your local browser to connect and reviewing the output messages.   Could you please confirm the following:   1. The root (and intermediate if applicable) CA(s) used to sign the imported Portal/Gateway certificate are deployed in the correct directories on the endpoint 2. The server certificate used for the Portal/Gateway has the correct CN (and SAN if applicable) attribute   I've included documentation discussing the certificate deployment options for GlobalProtect below for your reference also.   https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/get-started/enable-ssl-between-globalprotect-components/deploy-server-certificates-to-the-globalprotect-components.html     -Cheers ... View more

  Hey @Carracido    I know it's been a while since you've made this post, so I hope this message finds you well.   Since the certificates were generated on the firewall, we have the ability to renew them directly from the PAN-OS without having to re-deploy them.   I've included the document explaining this in further detail below for your reference.    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000POioCAG   Stay safe and have a great day!   -Cheers ... View more

@johan.boeckx    I know it's been quite a while since you've posted this, but I hope this finds you well.   In the past we started noticing issues quite similar to this in the now EOL 8.0 version. The fix to resolved this was included and confirmed in the latter 8.1.0 release.   If this doesn't (or did not) help, I would suggest calling into Support for further assistance from a TAC engineer.   I hope this helps!   Cheers ... View more

@sparker    I understand there's been a while since you've posted this, but I hope this finds you well.   If you've tried installing the Agent with admin rights, then I would suggest the following:   1. Disabling any third party anti-virus/firewall programs (such as Windows Defender, Norton, Sophos including web filtering, McAfee, etc) and retesting. 2. If it still fails, then you could view the Event log on the Windows pc and confirm if any relevant GlobalProtect logs are present 3. Collect Agent logs from the endpoint and contact Palo Alto Technical Support for further assistance.    I hope this helps!    Cheers   ... View more