About olloczky

Hi All,   I have a user who connects via a thin client with GP to our network. Actually we have around 50 users, but this one user has many problems. She gets disconnected multiple times a day. She tried multiple connections: her current residence with both wifi and cable, at her parents, both cable and wifi (2 different cities), and mobile data from her phone.   I gave her a different thin client (newer model), same problem. In the GP logs I can see only that the socket was closed and then the connection is decomssioned.    She is rightly unhappy right now and I have no clue what can cause this problem. Others dont face this problem on this regular interval. There are occasional disconnects but for the 50 user base it happens like 5-6 times a week.    Panos version: 9.1 GP version: 5.1   Thanks, Daniel ... View more

Hi All,   I have a security rule to allow ip "A" to ssh to ip "B". I can see the traffic actually hitting the fw but it gets dropped with interzone-default. The test policy match also verifies that it matches the traffic.   IP "B" is actually the firewall. And IP "B" is nated like this: original packet source IP "C", original packet dest  ip "A", translated packet source ip "B".   How can this happen? So the traffic hitting the firewall has an explicit allow rule but still missed.   IP "A" is on the other end of the IPSec tunnel and when this traffic comes, it successfully creates a child SA. Routing is also set up for IP "A"   Chhers, Daniel ... View more

Hi All,   I'm a medior network engineer who just got into a new position where I deal with PA FWs. I face the following issue now:   There is an IPSEC site-to-site VPN between my PA-850 (ver. 9.1.3) and a remote FW (I'm not sure about the remote device type). I see strange behaviours.   Yesterday 3 pm the rekey happened. It finished with ikev2-nego-child-succ event and created a Child_SA. But today morning all the keys got renegotiated starting with this event: Ikev2-nego-child-start. Description: IKEv2 child SA negotiation is started as responder, rekey. Initiated SA: *local_ip*[500]-*remote_ip*[500].   After this all the child SAs for the various proxy ids got deleted and then re-installed.   Note: I started the story with yesterday's rekey. That was also a chain of events like this, in which the rekey was not yet due.   Our workforce is relying on this IPsec tunnel, but that is also strange that on yesterday's failure they all experienced connectivity issues while on today's one they did not.    Please let me know if you have any ideas, or question.   Cheers, Daniel ... View more