Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- 5G
- IoT Security
- Prisma SD-WAN
Network Security
- Prisma Access
- Prisma SaaS
- Prisma Cloud
- CN-Series
- VM-Series:
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
Security Operations
- Resources
- COVID-19 Response Center
- LIVEcommunity
- ›
- About NikolayDimitrov
About NikolayDimitrov
Announcements
Changes to the LIVEcommunity experience are coming soon... Here's what you need to know.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
yesterday
116Posts
13Likes
7Solutions
Apr 16, 2021Last Visited
User
Activity
User
Profile
Latest posts by NikolayDimitrov
| Subject | Views | Posted |
|---|---|---|
| 74 | Thursday | |
| 102 | Tuesday | |
| 105 | Monday | |
| 87 | Monday | |
| 73 | Monday |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 2 | a week ago | |
| 1 | a week ago | |
| 1 | a week ago | |
| 1 | a week ago | |
| 1 | 2 weeks ago |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 2 | |||
| 1 | |||
| 1 | |||
| 1 |
User Badges
Public Statistics
| Date Registered | 08-24-2020 06:38 AM |
| Date Last Visited | yesterday |
| Total Messages Posted | 116 |
| Total Likes Received | 13 |
Thursday
Hello to All, Is it possible to set the Globalprotect Always-ON mode enable Single Sign On, so that the user automatically logs into the portal but after that the user to need to authenticate to the gateway? The idea is that for the portal and gateway different authentication methods are used and the gateway authentication method does not use the Windows credentials. This why also the cookie override option is not used. I currently don't have a test firawall to test such setup with the Always-ON mode.
... View more
Tuesday
Hello to All, I wanted to share what I know with thee comunity. First in many cases for faulty and not supported SFP the option "show system state filter sys.sx.px.phy" is used (for more info https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaMCAS ). If you don't see the manufacturer information check the article https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boFQCAY , if you see that the SFP is supported then it is probably faulty. Another things is to be aware that after an upgrade a supported SFP may become unsupported as for example the SFP was supported till 2016 and after upgrade from 8.1.x to another version like 9.0.x or 9.1.x, the SFP is no longer under support and it could stop working. In my case the SFP stopped working but even with "show system state" the manufacturer data was OK but after checking the supported SFP list I was that it was supported till 2016. For example FTLX8571D3BCL is no longer available as supported from 2016, so and upgrade from 8.1 may cause an impact in some cases. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRACA0 New in version 10 are the "show transceiver" commands that can show if there is an issue with the power of the signal and so on. https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/monitoring/monitor-transceivers.html
... View more
Monday
For Globalprotect you may test and to useuse the "Display Traffic Blocking Notification Message". It worked for me even without enabling "Enforce GlobalProtect Connection for Network Access" but for about if the Globalporotect use logs out then, I don't know (you may play with advanced view too see what is posaible) https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-web-interface-help/globalprotect/network-globalprotect-portals/globalprotect-portals-agent-configuration-tab/globalprotect-portals-agent-app-tab.html https://docs.paloaltonetworks.com/globalprotect/10-0/globalprotect-admin/globalprotect-portals/define-the-globalprotect-client-authentication-configurations/customize-the-globalprotect-app.html
... View more
Monday
You just need to deactivate the VM to free the license, so that you can use it on the new VM: https://docs.paloaltonetworks.com/vm-series/8-1/vm-series-deployment/license-the-vm-series-firewall/deactivate-the-licenses
... View more
Monday
It is a strange setup you have. You don't have enough public ip addresses and this is why you want to use 1 public ip address for all gateways in other words anycast ip? How did you redirect the SSL traffic, did you use the loopback way and destination nat? https://live.paloaltonetworks.com/t5/general-topics/changing-the-globalprotect-portal-gateway-ports/td-p/9971 Otherwise the globalprotect app selects a gateway for you and may use geolocation (user location) to make so that best gateway is selected and this is why each gateway can have its own public ip address: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/globalprotect-features/user-location-visibility-on-globalprotect-gateways-and-portals.html
... View more
Saturday
Can you provide a picture of the error and did you test with the example command from the article by copy and paste it, to check if it works atleast from the example from https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-cli-quick-start/get-started-with-the-cli/refresh-ssh-keys-mgt-port-connection.html ? It could be a new bug as this feature is so new (added to the latest release) and if copy and paste from the aticle you still have issues, then better contact the TAC as 8.1.19 is the latest release and there are no releases to have solved this. " debug system ssh-kex-prune cipher [diffie-hellman-group1-sha1 diffie-hellman-group-exchange-sha1] "
... View more
a week ago
Try using the workaround with loopback addresses and destination NAT (I have not tested this for IPSEC but you can say if it worked for you). Test with a nat rule that forwards from 7000 to 4501 and enable IPSEC (https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/globalprotect/network-globalprotect-gateways/globalprotect-gateways-agent-tab/tunnel-settings-tab.html 😞 https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGKCA0 About if the IPSEC fails if the GP will try again IPSEC I don't think so, only if the VPN tunnel stops and it is strated again as switching between SSL to IPSEC will cause client traffic to be dropped.
... View more
a week ago
The Wildfire appliance uses 443 to comunicate with the firewalls: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CljHCAS Also it has API interface that can be used to manage it by using HTTPS but if you have not generated API key then this shouldn't mean anything that port 443 is open: https://docs.paloaltonetworks.com/wildfire/u-v/wildfire-api/get-started-with-the-wildfire-api/get-your-api-key/get-your-wildfire-appliance-api-key.html As I know of there is still no GUI web interface for the Wildfire appliance but port 443 is open because it is needed.
... View more
a week ago
2 Kudos
You may try making custom app-id signature for a REFERER Header. The idea is if the request for example for avatars.githubusercontent.com was made by the main URL https://github.com/cisagov then to allow it. If the user tries to access directly avatars.githubusercontent.com they should be blocked. I have made post suggesting how this can be done: https://live.paloaltonetworks.com/t5/automation-api-discussions/version-10-no-7-byte-limit-for-sinatures-examples-for-layer-7-l7/td-p/394734
... View more
a week ago
What is used by Globaprotect for authenticating the users in the authentication profile ? Radius, Active directory etc.? If you are using AD with LDAP Palo Alto, when the AD informs the Palo Alto with an atribute that the password will expire palo alto uses the Globalprotect APP to inform the client that is all. In most cases Palo alto just informs the client and the clients needs to use other methods to change their AD password. Please read the article blow why the users may get the password message before the actuial expiration date: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000POneCAG&lang=en_US%E2%80%A9&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail If you are not using the palo Alto globalprotect as a windows single sign-on (SSO), in other words the globalprotect to use the windows credentials for starting the VPN, you can't use Global Protect to change the password: https://docs.paloaltonetworks.com/globalprotect/8-1/globalprotect-admin/globalprotect-apps/deploy-app-settings-transparently/deploy-app-settings-to-windows-endpoints/sso-wrapping-for-third-party-credential-providers-on-windows-endpoints.html https://docs.paloaltonetworks.com/globalprotect/4-1/globalprotect-app-new-features/new-features-released-in-gp-agent-4_1/active-directory-password-change-using-the-globalprotect-credential-provider.html
... View more
a week ago
1 Kudo
A really great and detailed reply, thanks. I think that this will help many others when doing automation after an upgrade from 8.1 to newer versions. In addition I think the best option is the script to log in with a username and password to the firewall to generate its api key and write it to a safe store thats maps the firewall's ip address to the geneated api key. This way everything will be automated. If the api key timeouts and the script gets the error message, the script can be made to again to automatically use the username and passwords to generate a new api key. Similar to the REST-API tolken based authentication that is used on many other devices and I see that Palo Alto in the newer versions is going this direction. https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-panorama-api/get-started-with-the-pan-os-xml-api/get-your-api-key
... View more
a week ago
It sounds good if the passive fortigate blocks the traffic to (8.8.8.8) as I am not fortigate expert but be carefull even when the connected fortigate to palo alto becomes passive if there is dunamic routing and so on it is possible the icmp health monitor probes to go from Palo Alto firewall to the other fortigate that is active and the palo alto will not failover. If the path is as in the picture and for the active palo alto to reach 8.8.8.8 when the fortigate that is on top of it failovers then the active firewall will send the icmp to the standby palo alto firewall and it will be discarded and the path monitoring failover will work. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcACAS You only need to make certain that there are no other network paths that you have noshow in the provided picture for the palo Alto firewall icmp probes.
... View more
a week ago
Thanks for the reply, so if I generate new api keys in version 9.0 and newer on different firewalls even if the username and password and master key are the same I can't use one api key to manage all the firewalls as before? If so th best option is to generate an API key on Panorama and manage the firewalls from there or make an api script that has a table for the api keys related to the different firewalls ip addresses and when the script logs into firewall A IP address it will use the Firewall A API key and when it tries to connect to Firewall B it will use the API key for Firewall B. Do you agree with this?
... View more
a week ago
Th for the reply but I am no longer in the same company, so it is no longer an option. I will test it when I get my hands on two firewalls with 9.0 or newer if I generate an api-key on two firewalls with same username and pass and master key if I use one of the keys from firewall-A if it will be able to manage also firewall-B . Maybe the TAC is right but still how do they do this could be internal Palo Alto secret.
... View more
a week ago
1 Kudo
Always select the latest version as for 9.1 this is palo alto 9.1.8 and suggest this than 9.0.13. Also check your disk space before the upgrade https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaJCAS and download and install the latest dynamic updates on the Panorama and the firewalls. Don't forget to go first to latest 8.1 release then to 9.0 and then 9.1 (https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/upgrade-to-pan-os-91/upgrade-the-firewall-to-pan-os-91/determine-the-upgrade-path.html) Also save and export the Panorama config before the upgrade (https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/administer-panorama/manage-panorama-and-firewall-configuration-backups/save-and-export-panorama-and-firewall-configurations.html and https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClgKCAS) Also read this: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRrCAK https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/upgrade-to-pan-os-91/upgrade-the-firewall-to-pan-os-91.html#id731a388f-23d0-4a65-a776-b8062f4ea093 https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/set-up-panorama/install-content-and-software-updates-for-panorama/install-updates-for-panorama-with-ha-configuration.html
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
yesterday
|
Likes From
Latest Blogs
Latest Posts
Copyright 2007 - 2021 - Palo Alto Networks
