About saraya

There was a malicious update to SolarWinds’ Orion platform blamed for global hacks.   It has been reported In a statement, "SolarWinds said it had just discovered its systems experienced, “a highly sophisticated, manual supply chain attack on Orion software builds for versions 2019.4 through 2020.2.1, released between March and June. “We have been advised this attack was likely conducted by an outside nation-state and intended to be a narrow, extremely targeted, and manually executed attack, as opposed to a broad, system-wide attack.” Administrators are urged to upgrade to Orion Platform version 2020.2.1 HF 1 (Hot Fix). A follow-up Hot Fix will be released Tuesday.”   Now Unit42 has released the blog https://unit42.paloaltonetworks.com/fireeye-solarstorm-sunburst/ All related coverages for SolarStorm and SUNBURST are covered on this Unit42 blog as of 15 Dec 2020.  ... View more

Auth logs forwarding can be also configured as Traffic & Threat logs from Objects > Log Forwarding.  Just select Log Type 'auth'.   For System logs, you will want to configure this from Device > Log settings > System.    Note: If you also enable Panorama/Logging Service as the 'Forward Method' , you must  configure log forwarding to Panorama . .     . ... View more

A llow Transparently —Automatically upgrade the app software whenever a new version becomes available on the portal ( It will typically connect, download, update, and then reconnect all with no interaction ).   Ensure that the user is not expecting the upgrade process to happen before the GlobalProtect client is connected to their network. This upgrade will not take place until after the connection to its network has been made to avoid loss of productivity for the end-user. After the connection has been established, it will then begin the task of downloading the upgrade automatically and transparently in the background.  After the installation of the new version, the connection may drop and reconnect to establish a connection with the new client version. Also, verify if users are experiencing high traffic in their network. If there is a high traffic situation, some clients could fail to download the package. GlobalProtect will delay the task by a randomly determined interval (1 to 30 minutes). There is no guarantee that every download will succeed the first time, but it will succeed eventually. The automatic update also depends on what the previous version was installed. If it is an older version, some existing information may have not been carried forward.   Note: The transparent upgrade will only work if the GlobalProtect user is running a lower GlobalProtect version than what has been activated on the firewall   Note: Make sure you have  DNS records for the portal on your internal DNS servers so it can resolve to the portal address and be able to download the new client version. ... View more

Make sure the Global Protect clients belong to the proper zone and proper NAT is configured (if needed), you might need to capture the traffic in the firewall and GlobalProtect Client.   If the packet captures indicate a problem with the GP client that needs help, engage TAC for assistance. ... View more

In case you are deploying this setup for Linux clients, you might want to consider upgrading to the Global Protect 5.1.6 version. GPC-11090 Fixed an issue where, when the GlobalProtect app was installed on Linux, users were not able to authenticate through SAML authentication when Microsoft Azure was used as the identity provider (ldP). ... View more

The restriction seems to be only with Ubuntu. There is a known issue already submitted for that behavior: " GPC-9415 -  For the GUI version of the GlobalProtect app for Linux, SAML authentication with Microsoft Azure does not work on Ubuntu 1804 or greater versions".   To work around this, we might need to apply the same workaround suggested for this issue " GPC-11090 -  Fixed an issue where, when the GlobalProtect app was installed on Linux, users were not able to authenticate through SAML authentication when Microsoft Azure was used as the identity provider". T hat was addressed in Global Protect v5.1.6.  They find out a workaround to make it work: One Login and Azure on Redhat, Ubuntu and CentOS. If the page is not loading completely, please right-click the sign-in page, select "inspect" and then select "reload" to make it work.   The doc team was asked to consider removing the note I mentioned above, as this may have been fixed.  As you are running Global Protect v5. 2, these issues/restrictions may be already fixed, and it seems like the limitation(s)  was not SSL related. You will want to contact support for the proper Global Protect logs analysis while using Linux distros and SAML authentication.   ... View more

The documentation only mentions this limitation for Ubuntu OS. So, you should not have problems at least with CentOS, since Fedora is not a supported flavor on Global Protect.     Ref doc: https://docs.paloaltonetworks.com/compatibility-matrix/globalprotect/where-can-i-install-the-globalprotect-app.html#id7a3c3401-b233-43b0-8d78-dfceab88798f_idbcd7ccf7-eceb-462c-8678-1a5fa51cbc18   There's a Feature Request for Linux Fedora Global Protect support (FR ID: 16103) already submitted.  ... View more

As far as I know, it cannot be possible. Once you use the same interface information for 2 different Portals and Gateways, you will receive these errors while committing the configuration:    Error: GlobalProtect portal 'Portal1' has used dynamic interface ethernet1/1 as GlobalProtect portal 'Portal2' Error: GlobalProtect gateway 'tunnel.10' has used dynamic interface ethernet1/1 as GlobalProtect gateway 'tunnel.20'   If you use non-dynamic interfaces, you will not even see the IP address in the second Portal or Gateway's IP address drow down menu.  ... View more

For browser-based applications, make sure you have ' Enable Inbound Authentication Prompts from MFA Gateways' set to 'No'. Under:   Network   >   GlobalProtect   >   Portals   >   <portal-config>   >   Agent   >   <agent-config>   >   App.   You might also need to check the 'Default Message for Inbound Authentication Prompts' option in the same 'App' section.  .  ... View more

The GlobalProtect App for Linux now supports Security Assertion Markup Language (SAML). You can authenticate users through SAML authentication in the GUI version and not in the CLI version.   Due to restrictions for Microsoft Azure support for Ubuntu operating systems, the GlobalProtect App for Linux does not support SAML when Microsoft Azure is used as the SAML identity provider.      ... View more

Do you see an intermittent blank 'source user' value on traffic logs (Monitor > Traffic) once it fails?  You may verify this by filtering in traffic logs the following: ( user.src neq 'source-user' ) and ( addr.src in x.x.x.x ).   If that is the case, most likely the User-to-IP mapping is being lost due to Timeout. Ref doc: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClZzCAK   You can either increase the User Identification Timeout or remove the check from the  Enable User Identification Timeout .   More information about User Identification Timeout: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PNVyCAO  ... View more