About brucegarlock

Yes, this is what I am doing, but what I don't understand is why those were not included as defaults like they were in the older models.  It seems like a lot of the default CA's included in previous PAN OS versions are not included on 11.x ... View more

It looks like dns-over-https to Cloudflare may be part of this.  We block dns-over-https so we can get insight into DNS traffic for inspection/protection.  When I see the error, the logs show dns-over-https being blocked when going to ChatGPT. ... View more

@eumbach I have pre-logon working with our Mac endpoints.  It wasn't easy, and I wish I took better notes.  Unfortunately, all I have in my notes is about the OS X machine certificate, and a link to this KB:  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClkECAS   Once I got the machine cert working with OS X and scripted its import via our on-boarding scripts, Mac's now work with pre-logon without any issues.  I also posted a similar reference to this issue 2 years ago on reddit.  https://www.reddit.com/r/paloaltonetworks/comments/ph1e83/macos_prelogon_vpn/   We also have rules in place that are very specific to pre-logon, and only allowing very specific access and denying all other access in case the machine got stolen, since there would be a connection to your infrastructure once you get pre-logon working. ... View more

Thank you very much!  This was so helpful in being able to listen to them while in the car. ... View more

The last news I have on my ticket which was escalated, just says they are aware and working on a fix, but no timeline.  There are a number of teams involved, which is also why it is taking a long time for a fix.     Since MS likely made changes to making getting creds more difficult, I am sure this is a good challenge for PAN.  I am guessing PAN may have to work directly with MS somehow.   This is such a great feature, and I hope they come up with a solution soon. ... View more

The Jira case ID is WINAGENT-830 ... View more

Glad to hear this is with engineering.  This is one feature when I talk to others in IT that really raises eyebrows.  Almost everyone I talk to would love to have a feature like this, and I think it's a great selling point for PAN firewalls.  I really hope engineering can come up with a solution.   ... View more

I am wondering if anyone has tested with a 2019 or 2022 RODC to see if the LSASS related patches might not be an issue with the cred agent after the Jan 2022 patches from MS.  I just tried April 2022 patches on our 2012R2 RODC, and it still goes into a bootloop.  We are only licensed for up to 2016, so the best I can try is an eval edition of 2019 or 2022, but if others are seeing this issue with those server versions, than I am not going to waste my time. ... View more

Do any other vendors offer a feature like this?  (i.e. prevent users from submitting domain creds to sites?)   I am going to raise this further with our SE.  I saw in the PAN Reddit thread that someone was a new customer setting this up for the first time.  That leaves a poor impression.  I really hope PAN can resolve this.  It seems like the change MS implemented broke the PAN agent, and if PAN is pointing at MS, maybe this is no longer technically possible?  ... View more

I got an update on our case and PAN is saying that this is a MS issue.  My questions back on the case to PAN are something like the following.  Right now, they are pointing at MS as the cause, but I am not clear on the following:   1.  Is this a bug in the patch?   2.  Is this a new policy MS is now enforcing on domain controllers that would prevent the User ID Cred agent from working properly?   3.  Is MS accepting this as a bug and going to fix it? ... View more

I wish...  I put in a S2 ticket last Wed, the 16th.  I did not even have my case assigned until the 18th.  Way behind on the SLA for a S2.  The current workaround is to reduce the security of the RODC, or disable the Cred agent.  I hope PAN fixes support.  Certainly a good problem to have (many new customers needing support), but not good for those of us paying for premium support, and not receiving it.     ... View more

I found this via a link in the paloaltonetworks subreddit, and was subjected to the couple of hours trying to figure out what was going on.  Luckily, I knew about the botched MS patches that caused bootloops, so uninstalling the patch tipped me off.  I then noticed that the cred agent was not connected properly to the FW, so I disabled the service and the server was stable.  As soon as I started it, I got the message that the server was going to reboot in one minute.  It doesn't even cleanly shutdown, it acts like issuing a reset in VMware.   The last patches that seem to work are December 2021.  Since our users continue to fail phishing test emails, I'll keep the Dec 2021 patches on the RODC for now until we get a fix.  I did open a case and recommended others do as well so it receives some priority. ... View more