About djrodb

I have successfully deployed GP and run logging scripts automatically post login. There is few issues though.... 1st issue - We ran into a major bug in PAN OS 5.0 - 5.2 that resulted in internet connection drop outs. We had to revert back to 4.1.8. GP was not the cause of the bugs. 2nd issue - We've not upgraded to PAN OS 5.x yet - waiting until 5.0.8 or later.... You need to make sure you install the correct certificate and the certificate is located in both stores on the local pc. You need to make sure you GP configuration is correct, As I don't have PAN OS 5 I can't post pictures -  however if you can, I can advise what is correct or missing You can check the VPN connection details view (Under VPN settings where you can view VPN session info) You boot your laptop and watch for the certificate authenticating on this view - before you press ctrl al del - this will tell you if your certificate configuration is good. If you authenticate pre logon then the problem is with GP VPN configuiraiton on PAN device. You need to make sure the certificate for pre-logon has pre-logon as its ID if the client certificate is not name pre-login then you will have trouble... That's all for now  - the trick is to get certificate authentication before you press crtl alt del - you can check in the VPN session view in GP VPN configuration - if you certificate authenticates then running the login script will follow automatically when you log in. It does work, I know it does. Hope this helps Rod ... View more

John Thanks for your help so far. I'm strugling with the concept of CP redirect and how the following statement translates to a working example. Make sure the host name or IP address you specify for the "Redirect Host" is accessible to the public. If you use a host name make sure it has a resolvable public DNS record Does this imply that the redirect host has to be an internal web server? or does it mean an interface on the firwewall - say for example the main firewall inside (trust) L3 interface? If it's an internal web server do I need to go through the normal procedure of creating a static nat from the out side to the inside server IP for the captive portal bit? I've added my current config to see if you or anyone else can clear this up? thanks. ... View more

John, Thanks. That cleared things up. I still can't get the system to present the redirected authentication login page. The documentation for Captive Portal hasn't been updated to PANOS 5 yet. Rod ... View more

I've resolved my problem. Please refer to https://live.paloaltonetworks.com/message/21662#21662 ... View more

Hi Albert. I've finally got this working. The problem was me settings in the GP portal config. I originally selected the LDAP group I'd configured under the user/user group setting in the GP portal client config. I changed this to any and it resolved the problem. This feature works really good. Thanks for you help. ... View more

Hi, I'm hitting the same issue. Can you or anyone clear up pre-logon definition? for example do I need to create a user called pre-logon on the PA and create a security rule matching the GP VPN or do I create a pre-logon user in AD? or do I not need to create a pre-logon user ID? I've got pre-logon partly working. The pre-logon feature fails with the error' user domain\pre-logon  failed authentication' invalid username/password' However when I log into the laptop with my AD credentials the GP client authenticates. Rod ... View more

Hi Albert pre-logon is a feature of the GP VPN client. The pre-logon function uses certificates and ldap authentication to lo the user into the laptop before you actually press crt alt del to log on. This allow you to run login scripts and patches on all remote laptops that come in via the VPN. My problem is the pre-logon feature isn't working 'pre logon' as I get user authentication errors. When I actually log onto the box and log in as normal the GP client logs me onto the network. So it works post-logon but not pre-logon. My ldap setting match yours so it doesn't seem to be that. Thanks for your help. Rod ... View more

Hi Albert can you post a picture of your LDAP config from your firewall. I've having some logon issues with pre-logon and I think it might be related. Thanks. ... View more

Some further information on why this isn't working... When the laptop GP pre-logon does not authenticate and I get the following error: GlobalProtect portal user authentication failed. Login from: *.*.*.*, User name: pre-logon, Reason: Authentication failed: Invalid username or password However when I log into the PC GP authenticates successfully and everything works as normal. ... View more

Hi - Can you tell me what you done re NAT? Thanks Rod ... View more

Thanks. This was the problem. My H.323 traffic was getting blocked due to the default time-outs associated to the H.323, H.225 and H.245 to the maximum 604800. I've documented why this happens below. (Courtesy of Rocketfire on vctalk) Once a call has been established, the signaling session on TCP port 1720 goes idle even though there's a VC in session. This is normal behaviour. Firewalls track individual sessions and will consider them dead after a short period of time if there's no traffic, typically 30 minutes for TCP. Firewalls don't give any indications to the endpoints that their session is now blocked. The endpoints could establish a new TCP session on port 1720, but they don't even know their old session is now longer working through the firewall. The TCP drivers in the endpoints will send a keepalive every so often. How often depends on the TCP drivers and how the sessions was opened. I know HDX's used to wait two hours before sending a heartbeat! Once the TCP driver in the codec fails to get a keep-alive acknowledgment, it will tear the session down, much to the surprise of the VC application. HDX's will drop back to their home screen without any error message when this happens. What other endpoints do is anyone guess. The clue is the repetitive timing of the failure, for example n x 30+13 minutes. Ideally endpoints will send TCP keepalives more often than the firewall timeouts. But this is rarely a configurable item. Usually people just wind-up the timeouts on the firewall "to eleven", particularly for TCP:1729. The problem with this is not everyone else has done the same to their firewalls, so timeouts could still happen in calls with them. Some firewalls will try to understand H.323 and make allowances for it, others will fudge up a TCP keepalive on behalf of an endpoint as a check before blocking the session. IMHO relying on firewall VC awareness isn't a good approach, as they are never fully VC aware. ... View more

Anyone got any ideas on how this works? or detailed instructions for getting it to work. I've noticed the pre-logon option removes the connect option from the GP client... interesting. Rod ... View more

HI mikand, Thanks for the reply. See attached. you get two options from Thawte. Option 1 is a PKCS #7 format that only contains one certificate. Then you get a X.509 option. This contains 3 certificates - End Entity, First Intermediate and second Intermediate. From your post are you saying I should copy the 3 X.509 options and past them into notepad and save it as a .pem file? if this is try should I follow logic and import the order of the certificates from thawte into my notepad following the format - first, second and then end? or should i follow the top down approach as it's layed out in the image - end, first and second? When I save it as a pem and import it into the PA do I then select the trusted root CA option? or do I leave all certificate options blank? Thanks Rod ... View more

Thanks for the reply. Our laptops are encrypted however there are some that aren't. Its easy to get around security polices locally on laptops using something like ERD commander which will allow you to create an admin user on the local PC - then you can run anything you want. Yes you can stop CD / USB access but your messing with functionality of the system. I suppose we can adopt the policy of only allowing pre-logon functionality for encrypted laptops only. Going back to my original question has anyone actually tested this? and is there anything to the configuration other that what i've listed above? Rod ... View more

Hi Mikand That presumes the IT department know about the theft and it presumes the IT Help desk follows the correct processes for dealing with an incident. What happens when a laptop is stolen over the weekend and there is no Help desk cover? at the very least the laptop could have 48 hours access to the commercial network before it's logged as stolen? For example you steal a laptop, you stick cain & able on it and dump the LSA table from it. You then log in as the domain user and have full access to the network. If this scenario can't happen then please correct me? if it can it does seem like there are to many varibles at play to consider this pre-logon funciton a secure one. That aside to test the pre-logon function out is it just a case of ensuring the GP configuration has a valid certificate that the PC knows about and then selecting the pre-logon funtion within GP client settings? Thanks Rod ... View more

Can you explain how two factor authentication fits into the picture? The idea off pre logon features is a good one, but what happens to a laptop that is stolen? If the tunnel is created pre logon doesn't this cause a security issue as it would effectively create a back door on to the network? re the certs, does the pre logon sequence use the certs that have been specified the potral client configuration? thanks Rod ... View more