About EddieRowe

Thanks for sharing the CVE.  I typically get those via email as published but have been out on holiday recently. ... View more

There are no issues with the April patches on 22H2.  Instead it appears the VMs for those versions were struggling to startup after patching and once I removed some older snapshots on the host side the performance issues went away in the VM so PanGPS started correctly.   I do think the design and execution of GlobalProtect could and should be improved.  Employees do NOT have any rights to tinker with PanGPS.  So if this service is not running after startup, there should be some logic built into the app to start the  service...don't just squawk about it not running...FIX it if you can by trying to start again after some period of time.  Since PanGPS v6.0.3 does not have any other dependencies there is just no reason to not have it take care of itself.  So it looks like PanGPS was written by someone who thinks UDP is the "bees knees" when we all know it is a horrible protocol if you need your data to get there... TCP handles that reliably well, but with a performance penalty so "individuals" seem to lust after UDP instead.  PanGPS suffers the same way... whatever part of GlobalProtect says to "start PanGPS" has no fault tolerance for the service not being able to start if there is a lack of resources which is a defect in my book.  GlobalProtect should be able to try starting the PanGPS service if it fails to start at boot. ... View more

Thanks for sharing the new target date is this month.   The info is in the security bulletin under the Solution section and is up to date as of 5/4/22. ... View more

CVE-2022-0778 Impact of the OpenSSL Infinite Loop Vulnerability CVE-2022-0778. GP 5.2.11 is vulnerable. Just surprised they fixed the issue in the 6.0 branch which no one should be using. ... View more

When we adopted GlobalProtect I was given bad information.  I was under the impression that the portal upgrade process was an all or nothing process.  So I used other tools to upgrade GP versions.  Royal pain as older releases required that you uninstall the app and then install the new version!  So I used AutoIT to create a script since it is a chicken and egg problem.  When it came to the 5.2.x version we ran into all sorts of issues where some systems upgraded and were completely broken which is no bueno even without COVID19.  If I had known you could control things by AD group I would have saved myself so much pain over the last few years!   Grab a copy of the documentation for GP and do some reading as the info is there!  You can use the portal to upgrade clients and control who gets upgraded!  Here are my notes based on my Windows setup: Create two AD universal security groups.  One for "Upgrades" and one for "Do Not Upgrade" which gives you some options.  Remember to update the Authentication Profile so these groups can be used in your authentication profile.   Clone your agent profile for GP.  Save one profile as "Do not upgrade" and one as "Upgrade".  Remember the first match wins so put the "do not upgrade" at the top, then upgrade and then your regular profile(s).   Edit the two new agent profiles so they use the matching AD security group. At this point all of your agent profiles are the same so there is zero chance for any harm.  Now add some test users to each of your groups, sync them to the Palo, login to GP on a test system with the test accounts and verify the agent profile is used for the users as you setup. For the "do not upgrade" agent profile double-check and make sure it is set to Disallow upgrades. (Should be since you are not using this) For the "upgrade" agent profile update  setup your preferences for upgrades.  I initially did "Allow with Prompt" to do testing and then moved to "Allow Transparently". Download the release of the GP client you want to use to the Palo and then activate it.   Upgrades should now flow to those in the "upgrade" AD group. If all goes according to plan you should now be able to add a few people each day to your AD group to upgrade folks across the company without incurring too much risk in case something goes wrong.  I always test the release myself, with my specific "use cases" of what must work.  I then add some IS staff who have admin rights so if something goes wrong they can recover on their own.  Then I move on to picking one model of each PC with one person for testing.  Since we moved to this process for upgrades things have been smooth sailing ( knock on wood). ... View more

I was looking for a way to exclude behavior protection from the IP address that is used by the scanner. ... View more

As luck would have it I cannot duplicate the issue now that I am back in town on test systems.   I did add the IP address to the malware profile under " Respond to Malicious Causality Chains", but I am not sure if this will resolve this issue.    The Action Center does not show the IP address of the security scanner as being blocked, but I don't know if that resets after some period of time.   Respond to Malicious Causality Chains ... View more

Thanks.  Now, if I can only get Palo Alto support to agree and resolve the issue of agents < 7.4 not upgrading to 7.4 when I am using option 3. ... View more

I have duplicated the issue with 7.4.1.31675 and 7.3.2.26319 as well so I can only guess this is an issue with our tenant.  Opening a support ticket. ... View more