This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About ggoudr
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About ggoudr
03-14-2023
27Posts
3Likes
2Solutions
Mar 14, 2023Last Visited
User
Activity
User
Profile
Latest posts by ggoudr
| Subject | Views | Posted |
|---|---|---|
| 7299 | 03-28-2018 02:17 PM | |
| 3969 | 05-24-2017 12:59 AM | |
| 4143 | 05-18-2017 09:01 AM | |
| 13483 | 06-17-2015 01:36 AM | |
| 13883 | 06-10-2015 11:10 PM | |
| 4910 | 06-03-2015 07:36 AM | |
| 3341 | 03-07-2013 03:56 AM | |
| 746 | 07-17-2012 02:23 AM | |
| 3874 | 07-05-2012 08:00 AM | |
| 4474 | 07-05-2012 07:13 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 05-18-2017 09:01 AM | |
| 1 Like | 01-25-2011 02:52 AM | |
| 1 Like | 06-03-2015 07:36 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 5 Likes | |||
| 1 Like | |||
| 1 Like | |||
| 1 Like | |||
| 3 Likes |
User Badges
Community Statistics
| Member Since | 11-09-2009 10:38 AM |
| Date Last Visited | 03-14-2023 01:56 PM |
| Posts | 27 |
| Total Likes Received | 3 |
03-28-2018
02:17 PM
Hello santonic, Have you ever tried to connect the Cisco SFP+ Twinax Copper Cables (SFP-H10GB-CU1M0 with PA-5050 device to see if link is brough up? I know they are not on the PA officially supported Cables, but some Third-Party transceivers/cables may work (without warranty) and I want to know if this SPF+ DAC is one of them (if you have experience of it). Or did you finally purchased PAN compatible DAC/transcievers? Kind regards George
... View more
05-24-2017
12:59 AM
Yes, I agree with you maybe a Feature Request is not a bad idea. After all, there are some requirements on disabling weak ciphers etc on PCI and CIS compliance audits that PAN Devices do not give that opportunity. George
... View more
05-18-2017
09:01 AM
1 Kudo
Hello all, I have noticed an important difference in PANOS v8.0 in comparison with PANOS 7.x.x concerning the SSL settings for the GlobalProtect portal. More specific, the famous site for SSL Server tests, Qualys SSL Labs presents PANOS 7.0.x with Grade A-, while for PANOS 8.0.x the grade is lowered to Grade B (worst). This happends because, while in PANOS 8.0.x there is a wider support of ciphersuites fot TLSv1.2, the additional ciphersuites supported use weak weak Diffie-Hellman (DH) key exchange parameters. More specific, for some cipher suites, the DH key exchange is weak, as 1024-bits are being used. More specific, for version 7.0.x, the Cipher Suites list is the following: TLS 1.2 (suites in server-preferred order) TLS_RSA_WITH_AES_256_GCM_SHA384 (0x9d) 256 TLS_RSA_WITH_AES_128_GCM_SHA256 (0x9c) 128 TLS_RSA_WITH_AES_256_CBC_SHA256 (0x3d) 256 TLS_RSA_WITH_AES_128_CBC_SHA256 (0x3c) 128 TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) 128 while in PANOS 8.0.x the list is the following: # TLS 1.2 (suites in server-preferred order) TLS_RSA_WITH_AES_256_GCM_SHA384 (0x9d) 256 TLS_RSA_WITH_AES_128_GCM_SHA256 (0x9c) 128 TLS_RSA_WITH_AES_256_CBC_SHA256 (0x3d) 256 TLS_RSA_WITH_AES_128_CBC_SHA256 (0x3c) 128 TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) 128 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) ECDH secp521r1 (eq. 15360 bits RSA) FS 256 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) ECDH secp521r1 (eq. 15360 bits RSA) FS 128 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030) ECDH secp521r1 (eq. 15360 bits RSA) FS 256 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f) ECDH secp521r1 (eq. 15360 bits RSA) FS 128 TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x39) DH 1024 bits FS WEAK 256 TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x33) DH 1024 bits FS WEAK 128 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x9f) DH 1024 bits FS WEAK 256 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x9e) DH 1024 bits FS WEAK 128 The big question is how to disable these weak Forward Secrecy (FS) DH Weak key exchange exchange parameters as there is no option to manipulate these settings either from the Web UI or the CLI. Maybe the new SSL/TLS Service Profile that appears in PANOS 7.1.x should have something for the CipherSuites and the Forward Secrecy (FS) key exchange parameters that need to be enabled/disabled/used (and the order they are being presented to the client's web browser. Regards, George G.
... View more
- Tags:
- globalprotect
06-17-2015
01:36 AM
Yes I was able to access the portal website without any problem. Actually I detected that the problem was with the user not belonging to the proper user group. So, adding the user to the group resolved the problem. George
... View more
06-10-2015
11:10 PM
Hello Sven, I have similar problem that is related with a specific (so far) Windows 7 64bit machine and in the same time with certificate profle enabled on the GP portal. There are no proxy settings defined anywhere, either there is any script importing any kind of proxy settings. Moreover, with the same GP client I am able to login to other GlobalProtect Portal/Gateways without problems. The workaround with the winhttp settings did not help me at all and the issue still persists... Giving the command netsh winhttp show proxy returns me Current WinHTTP proxy settings: Direct access (no proxy server). So this is not the path for the resolution, but something else more deep...
... View more
06-03-2015
07:36 AM
1 Kudo
Unfortunately I have tested SSL Decryption with Site that supports TLS1.2 and PANOS 6.0.10 with the latest version of firefox (v38.0.5) and I get "Secure Connection Failed" because firefox 38 does not failback from TLS version 1.2 to TLS version 1.1 as mentioned in the following https://support.mozilla.org/en-US/kb/tls-error-reports since TLS1.1 is considered insecure TLS version by mozilla foundation It seems that the problem appears only if the Cipher suite of the site is TLS_RSA_WITH_AES_256_CBC_SHA256 and SSL Decryption with TLS1.2. This does not apply for Cipher Suite TLS_RSA_WITH_AES_128_CBC_SHA256 and TLS1.2/
... View more
03-07-2013
03:56 AM
Dear alll, I am trying to disable a specific rule from the security policy using the XML api... I am sending the following URL: https://192.168.1.1/api/?type=config&action=edit&key=<my_key_here>=&xpath=/config/devices/entry/vsys/entry/rulebase/security/rules/entry[@name='rule1']&element=<disabled>yes</disabled> But as a result I get the following error: <response status="error" code="12"><msg><line>Edit breaks config validity</line></msg></response> What am I doing wrong? George
... View more
- Tags:
- xmlapi
07-17-2012
02:23 AM
Maybe because the Network 10.101.255.0/24 is not behind the zone Guest-Trust zone. You should verify in the logs that from the Guest-Trust zone you always have this kind of network and not something else. So for the second Screenshot I would be more specific and put both the Guest-Trust zone and the Network behind it in the source fields to be more specific.
... View more
07-05-2012
08:00 AM
Did you try to set the authentication profile of the user to "None" ? Then you need to commit in order for the changes to take effect. Because as I can see in the log you have attached, the "test" administrator tried to authenticate using a defined authentication sequence. Try to set the option "None" instead of the authentication sequence... Also, be aware - and this is very important - that the usernames are case sensitive. In the logs I can see user 'test' but not user 'Test' as you have mentioned you created... Regards, George
... View more
07-05-2012
07:13 AM
I have reviewed your HTML code and carefully read your comments. As I can understand, the captive portal feature of PA is not used at all. What you are using is a custom "continue and override" page of URL Filtering in combination with a url-filtering profile that has in all categories the "continue" action (or the categories you want to allow). I have to note the following: 1. The Wireless Guest should be allowed to view the images from the untrusted zone without having to pass through the URL filtering profile, so a rule that allows the Wifi Guest to access the ip of the yamaha server hosting the images (source zone untrust source address will be the subnet of the Wifi Guests, destination zone should be the trusted zone and destination IP of the yamaha server. Also the Wifi Guest must be able to DNS resolve the yamaha host to an IP that must be accessible by him. I have opened myself the test page attached and indeed the images are shown as broken, because you haven't allowed for me to access the yamaha server from the internet and maybe this or similar is the case of the Wifi clients. Maybe you need to be placed in the Wifi subnet and do the tests from there and modify the firewall rules appropriately in order to be able to view the images on the "continue" page. Regards, George
... View more
07-05-2012
06:54 AM
The useridd process should not take more than 20 seconds to restart. During that period User Identification may not work properly. There is no GUI option to restart the user-id process, since this is done only in special cases. On the other hand, since it is version 4.1.6, are you using the old (version 3.1.x) panagent installed on a member server, or are you using version 4.1 of the User-ID Agent? Here are some updated docs for the newer agent and 4.1.x software. Please let us know if this is what you were looking for. 4.1 Agent setup: https://live.paloaltonetworks.com/docs/DOC-2132 4.1 User-ID Upgrade Technical Note If you are using the new User-ID please read carefully the Tech Note. since the agent is used only for the NTLM Authentication and Identification part of the ActiveDirectory/Domain (reads logs, logon events etc) and does not retrieve groups anymore from the active directory. Group retrieval is done through the PAN firewall via its management interface and using the configured LDAP Profile(s). Regards, George
... View more
07-05-2012
03:17 AM
I think that the problem is with your HTML code, it is not palo alto networks related... You should not use the "href tag for the images to be displayed in the page but the "img src" tag. Try to load the HTML page locally on your PC and see if the image displays correctly there.
... View more
07-04-2012
02:47 AM
Dear mikand, While this topic has been answered i would like to state my opinion as well. The commit process is that the unit on which you do the commit will do the verification, the compliling of the configuration xml together with a bunch of other tests that will then be applied to the dataplane. AFTER the commit finishes on the unit, the configuration will be transfered to the paired unit and then a "HA Sync" event will take place. The HA Sync task is nothing more than another commit to that device (delta commit) but it will be a little bit faster because initial compilation does not take place (the configuration is already compiled when sent to the paired unit(. Be careful and always do the changes on the same unit, to avoid configuration conflicts. Moreover, it is a good idea to check that the HA Sync task on the paired unit has finished successfully before doing another commit on the unit you are usually committing. And always make sure that both units have the same application, threat, antivirus and url filtering versions (depending on your license some of these features would not be updatable) are the same on both units, and with most important the Application Database version (the appid's). Regards, George
... View more
07-04-2012
02:05 AM
Hello, I would like to answer your questions based on my experience. Until version 4.1.5.x the AD groups information is being retrieved by the User Identification Agent (the pan-agent 3.1.x) running as a service on a member server. Thus refreshing the group membership, the group names etc affects the configuration of the User Identification Agent, when clicking the "Configure" button. There, you will see the Age-Timeout in minutes and the User membership timer, values that will affect the membership and refreshing of the groups. Also you may want to disable Group Caching. By adjusting these settings you will see different results. In version 4.1.6 and later there was a change in User IDentification and now the new User-ID agent will be used for NTLM authentication (i.e. for Captive Portal). So the group mapping/retrieval is done by the Firewall itself (through its management interface) by also configuring the appropriate LDAP server settings. In the group mapping settings there is also an update interval (in seconds) for the group mapping process. 2) You may force the refresh of the groups by restarting the Pan Agent Service on the member server (until version 4.1.5) and by also clicking the get groups button in the Palo Alto Networks User Identification Agent UI on the member server. Also following the following procedure will definitely refresh groups: Stop PanAgentService on the member server, delete the file "C:\Program Files\Palo Alto Networks\PanAgent\group_members.txt" and then restarting the service again will refresh the groups and group membership (it will help more if you click also the "Get Groups" button from the User Identification Agent UI). In version 4.1.6, you will need to restart the useridd process on the Active PaloAlto unit, by issuing the command "debug software restart user-id". I hope my answer helps you. Regards, George G. ENCODE S.A. - Palo Alto Networks Partner in Greece
... View more
06-10-2011
02:20 AM
Hello everybody, When enabling Captive Portal either in vWire or Layer3 mode, the Layer3 interface that is used for redirection and has the "Response Pages" option enabled, is listening to certain ports for Captive portal. Let's say that the configured hostname for redirection and for NTLM host is "palo alto" and is pointing to the IP address 10.0.0.1 of the ethernet1/13 interface. The ethernet1/13 interface has in the Interface Management profile assigned, also checked the option "Response Pages" and also the "Ping" service checked, but not the other services (telnet,ssh,http,https and snmp that are unchecked). With the abovementioned configuration, thhe ports that the interface ethernet1/13 is listening are the following urls: http://paloalto:6080 http://paloalto:6081 https://paloalto:6081 http://paloalto:6082 https://paloalto:6082 I have the impression that port 6080 is used for NTLM authentication and for Captive portal authentication (page with title "User Identification Portal" for protocol HTTP only (unsecure connection). Port 6081 is used for NTLM and Captive Portal Authentication for protocol HTTPS (secure connection). I do not understand the existence of port 6082 in PANOS 4.0, which seems that is listeing for protocol HTTPS and serving both NTLM and Captive Portal Authentication More specific, in order to test the abovementioned, I have used the following URLs: http://paloalto:6080/esp/ntlm.esp?vsys=1&url=http://www.google.com http://paloalto:6080/esp/uid.esp?vsys=1&url=http://www.google.com https://paloalto:6081/esp/ntlm.esp?vsys=1&url=http://www.google.com https://paloalto:6081/esp/uid.esp?vsys=1&url=http://www.google.com https://paloalto:6082/esp/ntlm.esp?vsys=1&url=http://www.google.com https://paloalto:6082/esp/uid.esp?vsys=1&url=http://www.google.com Please explain me when each port is used. Thank you, George G. Athens, Greece
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-14-2023
01:56 PM
|
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks