About Daniel_Li

Thank you Sai. It is very useful link. Actually we are not able to get the excluded domain (zooom or www.cisco.com ) working. Ticket was in engineering escalation   Daniel ... View more

HI!   For Zoom domain excluded. So far it is not working. Symptom is not stable some client works and then stopped when they go zoom from Browser. It will not display. Case is on engineering team. If anyone got excluded domain working and stable. Please share your comments   Thank you   Daniel ... View more

Just update all   Split domain on GP 5.1.0 has bug and release note mention it is fixed on 5.1.2 or 5.1.1. So far it works on some machines and other machine is not working 100% for example following domain is in excluded list GP 5.1.1 or 5.1.2 *.zoom.us      -some GP client works and some does not *.cisco.com   -some GP client works and some does not speedtest.net  most of time this Domain traffic will send to physical adapter   Still not fix yet with Tech.   Daniel ... View more

Thank you Nehal for the useful link for troubleshoot.   I tried netstat -anob on window 10. It does not display adapter info for connection which shows connection to Zoom IP exiting at physical adapter. Pcap will show the info.   C:\WINDOWS\system32>netstat -anob | findstr 52 (52.202 is zoom.us IP) TCP 0.0.0.0:49666 0.0.0.0:0 LISTENING 1752 TCP GP IP.3:30390 52.202.62.232:443 CLOSE_WAIT 10596 TCP GP IP.3:31060 52.96.50.98:443 ESTABLISHED 2124 TCP GP IP.3:32232 52.96.50.130:443 ESTABLISHED 2124 TCP GP IP.3:32324 52.114.128.70:443 TIME_WAIT 0 TCP 127.0.0.1:1521 127.0.0.1:1522 ESTABLISHED 10436 TCP 127.0.0.1:1522 127.0.0.1:1521 ESTABLISHED 10436 TCP 192.168.0.17:3429 66.199.36.52:443 ESTABLISHED 7984 TCP 192.168.0.17:49420 52.177.166.224:443 ESTABLISHED 5080 TCP [::]:49666 [::]:0 LISTENING 1752 UDP 0.0.0.0:54908 *:* 2520 UDP 127.0.0.1:52597 *:* 2124 UDP [2607:fea8:329f:e653:e8b2:bccd:6d37:5242]:2177 *:* 2832 UDP [fd00:8494:8cd1:3322:e8b2:bccd:6d37:5242]:2177 *:* 2832 UDP [fe80::e8b2:bccd:6d37:5242%13]:1900 *:* 5988 UDP [fe80::e8b2:bccd:6d37:5242%13]:2177 *:* 2832 UDP [fe80::e8b2:bccd:6d37:5242%13]:59606 *:*   Daniel ... View more

Thank you Joe. Update is current. We have opened a ticket with TAC.   Daniel ... View more

HI !   I enabled trial license for Global protect gateway license and follow the link below to try to allow zoom traffic go out via physical adapter in Global protect client 5.1.0 PANFW firmware is 8.1.12. It does seems to be working. Does it require portal license in additiona to gateway subscribtion. If now how to prove it is working. Our tracert  zoom.us from GP client (full tunnel mode) still goes out tunnel (we did restart gp services/reboot client window OS)   Any suggestion is appreciated   https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/GlobalProtect-Implement-Split-Domain-and-Applications/ta-p/316929 ... View more

HI Sai   I installed 90 days trial Global protect gateway. Is that enough ?  It does not work after following the link.  tracert  zoom.us on Window 10 shows going thru tunnel interface, not physical one  ( restart GP service a few time, no access route configured ), I use GP 5.1 for window client. if add route in excluded access route. it works but zoom.us IP is changing sometime. Any suggestion is appreciated   Configuration is used in the link https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/GlobalProtect-Implement-Split-Domain-and-Applications/ta-p/316929     ... View more

Thank you SuperMario for the reply.   I have installed 90 days trial Global protect gateway. Is that enough ?  It does not work after following the link.  tracert  zoom.us on Window 10 shows going thru tunnel interface, not physical one  ( restart GP service a few time, no access route configured ), I use GP 5.1 for window client. Any suggestion is appreciated   Configuration is used in the link https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/GlobalProtect-Implement-Split-Domain-and-Applications/ta-p/316929       ... View more

I am trying setting up to split zoom traffic via physical adapter following the link. All traffic goes thru tunnel except zoom. I am not able to get it work without adding route in excluded access route. We have Gateway subscription license but not portal license.   Just want to confirm if we follow the following link (not mention adding route in excluded tab), Link says it needs Global protect license, Is it portal license or just gateway subscription license   Thank you   https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/GlobalProtect-Implement-Split-Domain-and-Applications/ta-p/316929 ... View more

Thank you Kelly. Is there guide (not admin guide) to configure multiple interfaces in a zone. For example, zone 1=ingress interface and zone 2= egress interface, or it can be mixed. Traffic from wan X enter interface 1 and exit interface 2 (WAN y will be interface 5, 6) and then enter interface 3 and exits interface 4 before they get on internet. Can I set up my zone Zone in=interface 1 and 5 Zone out=interface 4 so FTP (e.g) enter interface 1 and 5 and exit interface 4 will have only one session. On the other hand, I do not see anything wrong with two sessions per Application. but Firewall may be overloaded due to double inspection. I asked support some questions. i was told they need to talk with team to get back to me. Daniel ... View more

Thank you for the help. Two sessions means two Session IDs due to traffic passing PA device twice. ... View more

Thank you Rod. Glad to know that script is working on your network 1.   1st issue -- Are you using PA as corp firewall or just Vwire. we got two bugs after upgrading to 5.0.3 with network, we rolled back to 4.1.7h2. Currently waiting for last one bug fix 2.   2nd issue -- I had some screen shots of setting (not all) Basically we followed https://live.paloaltonetworks.com/docs/DOC-2020. Cert is on tested laptop and we did see pre-logon in admin webgui before alt,del and ctrl keys are pressed. We unchecked Ipsec and use SSL only.  but we did not put pre-logon (we use any)  in source user client configuration on page 50 of DOC-2020 Question:  Do you leave blank on LDAP configuration under Domain section ?                 Is VPN connection detail on GP client or on Admin GUI ? I am also waiting for bug fix ( we have already been hit by lots of bugs). So we have 85% CPU on Dataplane not sure what your DP usage during peak hours. Will do the GP test on the new firmware Thank you Daniel ... View more

logon scripts or Group Policy? ----logon script via AD (not using GP) SSO is enabled.  There is bug in 5.0.3 we revert back to 4.x. so not able to provide xml. but I need to know if anyone had it successful deployed. I can provide you case # if you have access to support portal ... View more

Thanks I see the info in page 52 of Doc. So How can we get script working when user is not in office based on the AD group. I see page 336 of PA5.0 Admin guide about Pre-logon details.(including drive mapping) what setting are missing in my configuration (add pre-logon as user in security policy and authentication profile ?) Have you get script working in either lab or production ? ... View more

Sorry. I had incorrect information in my previous emails Script working setting: Any/Any/Any setting in the 3 places (security policy/authentication profile --we used Radius/portal client configuration ) Script not working:      Domain/group name or cn=xxx format/domain/group name or cn=xxx/Any Note: cn=xxxx are defined in Group mapping under User identification. Thank you for your time to help on this issue ... View more

Sorry i missed the question everything is working except the script=drive mapping ... View more

3rd place is default=Any, we did not touch 3rd place in our test. ... View more

Thanks Albert. There are two places to add user/group (authentication profile and security policy) If both place are Any. logon script will NOT work in our case. I have not tried one Any one user/Group. Basically we only allow staff to get authenticated not Students. We followed Doc 2020 for setup. Is there fix to get logon script working with pre-logon SSO setting. My understanding for pre-logon with SSO 1. User (not in office network) with pre config wired or wilress internet connection, power up machine without logon window. Pre-logon is already established between user laptop GP client to PA portal 2. user login with AD user and GP starts to connect using AD user (SSO) and then user starts logon  corp domain/scripts/drive mapping Not sure if Palo Alto staff use pre-log feature to get home drive mapped at home. We use Juniper/Cisco and it works well. ... View more

Refer to djrodb Dec 10, 2012 1:50 AM I would like to know logon script working on our GP Pre-logon. We had an issue that logon script is not working if we put group either  domain\user group or LADP format  cn=network_tech,ou=groups,dc=domain,dc=com but if we put any in source user in security rule and authentication profile it will works. For LADP config. We leave domain name empty which is suggested by Tech. GP user can authenticate without problem and go to network resource and map drive manually but logon scripts is not working. Please share your experience if possiable Thank you Daniel ... View more