About laurence64

Ok, so after finally getting the time to upgrade the firewall (PA-220) the problem is resolved, it seems to be fixed in version 10.1.5-h2 at least for me, TAC recommended disabling IPv6 Firewalling but this did not solve the problem, there were no other suggestions as to how to workaround it, looking back over this thread it appears that for some it worked when certain time frames were used and others when they upgraded to 10.1.5, so give 10.1.5-h2 a try and hopefully it will resolve the issue. ... View more

Hi   As @OtakarKlier   has said I am not sure why you wouldn't be using the PA in place of the Fortigate, however to answer your question, I imagine that the issue will come when you start to push more than the 2Gb through that link (which is now possible as your upstream is now 4Gb) then the switch will have no option but to queue the traffic and as the interface buffers become full it will start to tail drop the packets, so if you have critical or connection sensitive traffic you would have to control the flow through Qos. Hope that helps. ... View more

Hi  SSL Decrypt is controlled via URL category and you can also use ports within the Decrypt policy, frankly I am shocked that Telegram does not use a pinned-cert, if it did it would be in the Decryption exclusion list Device > SSL Decryption Exclusion  however the best thing to do would be (in the absence of any useful info on the Telegram website) carry out a packet capture on the firewall and identify the traffic in question and more accurately check where the app is going URL wise. A good starting point would be a custom URL category with Telegram added and then a do not decrypt policy above your broad decryption policy, however the packet capture would show the detail and this could also be added to the URL category.   ... View more

I think I will have to raise a TAC case for this, it was supposed to be fixed in 10.1.4 as far as I remember and so I was waiting to go to 10.1.5 and hope fully get around it, will let you know how it goes! ... View more

Any news on this? I am am running 10.1.4 and it is still an issue. ... View more

Hi   Hi @Miroslaw_Iwanowski    I am not sure why you would have been ignored, but if you sign up to download the Cortex XSOAR then you will get the trial version (without the limitations on reporting and commands in one day) after the 60 (I think it is) period it will revert to the community edition, this has a limit 166 commands in one day and the reporting is severely limited, other than that it is pretty much fully functional, threat feeds are limited to 100 objects though so they are more for practise and eval than anything else.   Hope this helps ... View more

Have you opened a case with TAC ? ... View more

I have to admit I know of a few people now that are running it and nobody seems to be having any major issues at all! ... View more

Hi@kiwi no I was more interested in if it had been trialled as it was not really mentioned during the webinars that I have been on, you are completely correct with the versions though, the first one is not always the best move.@stevegreen0 although as I say kiwi is right I have a colleague who has gone to 10.2 in a lab and says there is an improvement in gui response so it sounds positive but I think I will wait for the preferred version to be released. ... View more

Did you really not find a solution to this? I am sure we can figure what is happening as this should be a workable configuration, let me know if you want to continue trying to fix the issue.   The problem I think is that logically speaking the VPN host is actually on a different interface to the host that you are trying to reach, so when the target .18 host tries to reply it simply arps out for the MAC address in  standard way, I think that there should be a mechanism by which it can resolve the tunnel interface for the destination. ... View more

This looks suspiciously like permissions issues when installing the PAN-GP adaptor    T13212) 01/12/22 08:51:51:598 Error(1566): InstallClientConfig: Failed to find PANGP virtual adapter interface (T13212) 01/12/22 08:51:51:598 Error( 343): InstallClientConfig() failed (T13212) 01/12/22 08:51:51:598 Error( 248): ProcMonitor: SetupNetwork() failed (T9064) 01/12/22 08:51:51:598 Info ( 471): PktProcess: VPN disconnect event, get out of ProcMonitor   Is the user a local admin or have admin privileges ?   It may not be the issue but worth looking at for a start. ... View more

Hi    As @BPry  has advised there is many issues with the installation of the GP client on windows 7, without the logs I too am unable to assist with any analysis ( I have no idea unfortunately why they keep disappearing from here ) if you have the licenses for it I would suggest that you could possibly clientless VPN for users that are running such legacy operating systems. ... View more