This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About andeporter
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About andeporter
04-14-2022
6Posts
0Likes
0Solutions
Apr 14, 2022Last Visited
User
Activity
User
Profile
Latest posts by andeporter
| Subject | Views | Posted |
|---|---|---|
| 3350 | 05-11-2020 03:20 PM | |
| 2612 | 05-11-2020 03:15 PM | |
| 6703 | 05-08-2020 01:57 PM | |
| 2679 | 05-08-2020 01:48 PM | |
| 2170 | 05-08-2020 01:33 PM | |
| 2214 | 05-08-2020 10:22 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 2 Likes |
User Badges
Community Statistics
| Member Since | 05-08-2020 10:09 AM |
| Date Last Visited | 04-14-2022 02:38 PM |
| Posts | 6 |
05-11-2020
03:20 PM
In a very crude, general sense... If your GP is setup to establish the connections using SSL, you can get a rough idea from the ACC tab >> Network Activity tab You can filter that down further to include the zone for your GP connections. HTH Thx, Ap.
... View more
05-11-2020
03:15 PM
I think I understand your question a little better now. So there are a number of different ways to do that. I would start by looking at your options in the Config Selection Criteria section of your GlobalProtect Portal Configuration: Network Tab >> GlobalProtect >> Portals >> Click the portal >> Agent tab on the left >> GP Client Config settings >> Config Selection Criteria >> Device Checks or Custom Checks From there you can assign different portals/profiles. HTH Thx, Ap.
... View more
05-08-2020
01:57 PM
Marsooq, I have the setup you are describing and Sutare is correct. You would have to have multiple Portals (for each ISP) for your GlobalProtect users. HTH. Thx, Ap.
... View more
05-08-2020
01:48 PM
Rjdahav, It seems like you have a pretty good handle on how to accomplish this. You've already established that each set of customers will need their own IP address/range pool based on the fact that they all need to have restrictions to separate, internal ranges. Customer A - Global protect pool of something like 172.16.1.0/24 to 10.1.1.0/24 from our internal network Customer B - Global protect pool of something like 172.16.2.0/24 to 10.1.2.0/24 from our internal network Customer C - Global protect pool of something like 172.16.3.0/24 to 10.1.3.0/24 from our internal network The control can then be established via the routing setup for each group. Can a user get the same IP address via Global Protect each time? Yes, but why would you want/need this? https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIMCA0 I'm not sure what you mean by "bind users to customers". Can you give me a little more background here? HTH. Thx, Ap.
... View more
05-08-2020
01:33 PM
Sutare, Thank you for the reply. We are currently not NAT'ing any traffic across the VPN, and the problem only exists on that single ATA 191 device. The link you sent me is intriguing, but I'm very hesitant of going down the road of changing the Outgoing Transport Type from TCP to UDP for our entire CUCM in an effort to correct a problem with a single ATA. It seems like there would be significant risk in terms of call quality if changing from stateful TCP traffic to straight UDP (throw packets at the wall and see what sticks), no? Any other advice you could offer would be most appreciated. Thx, Ap.
... View more
05-08-2020
10:22 AM
Hello Community, My company has a Cisco VOIP phone system. We recently switched over to PAN220 to PAN220 firewalls w/ IPSEC VPN tunnel connectivity between our two locations. We are experiencing significant problems with a single Cisco ATA 191 SIP device: https://www.cisco.com/c/en/us/products/collateral/unified-communications/ata-190-series-analog-telephone-adapters/datasheet-c78-739907.html This phone regularly has call audio and or connectivity problems where the caller places a call and they can hear the far end receiver, but that person cannot hear the caller. Other times the call will hang, fail, etc. The device is currently configured to require the media termination point (CUCM phone server) for calls/connectivity. The CUCM server is located back at the head end and the ATA is located at the remote VPN site. Our firewalls are currently set to alert-only as they are new and we have not turned up the features yet. We did not seem to have this issue prior to switching to Palo Altos (away from the ASAs). Things we have tried on the Palo Alto: 1. Disabled SIP ALG 2. Policy override for device traffic 3. Different Crypto/IPSec tunnel encryption/settings 4. Logging/wireshark/packet captures (no evidence of dropped packets or blocked ports/protocols) Other phones (Cisco 8851s) work without issue at the remote end. It seems to be something related directly to the ATA 191 and the Palo Altos. I have scoured the internet but have not seen anything similar to this issue. Are there any Palo/CUCM buffs out there who might be able to throw me a line?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-14-2022
02:38 PM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks