About Palo_lover

Can we change the automatic configuration script option in the browser to point to a desired URL where a pac file lives during sign in to Global Protect? Basically enforcing a value as part of logging into the VPN. Cisco Anyconnect does that so i was trying to find a similar function in GP. ... View more

Hi, We are running Palo Alto Global Protect with Symantec VIP MFA. We have run this for quite some time now and it has been stable until recently. We are seeing random errors appearing on one of the validation servers. It seems Palo is sending the request but Symantec is dropping it. A restart of the validation service on VIP EG fix the issue temporarily but it appears atleast once a day everyday. I have taken a wireshark capture when the error was happening. You can clearly see the firewall making the request with no response from the server and from packet 7527, this is where i restarted the validation service on Syamentec running on the port you can see response going to the firewall.   Understand this looks more like a Symantec issue but the change was made on the firewall which triggered these errors. On Palo i have started using Authentication sequence which goes through 3 profiles. 2 X LDAP and last one Radius. 1 x LDAP is not in use and i will be deleting that. The radius one has been recently added using Okta MFA. Surprisingly when i remove the profile from the sequence on Palo no errors are seen on Symantec VIP MFA server. I have tested this a number of times now at the cost of some operational impact :(. No other way to reproduce the error. Ignore my feeble attempts to mask the IP.     SYMANTEC LOGs: INFO "2021-03-22 12:54:30.027 GMT+1100" 0.0.0.0 RADIUS_SCC_ALL:1901 0 0 "text=Sending Acces-Reject for user [amarsh] , reason=47; Invalid Input." Thread-2932 VSAuthOTPStandardControllerImpl.cpp AUDIT "2021-03-22 12:54:30.027 GMT+1100" 172.18.17.254 RADIUS_SCC_ALL:1901 0 24597 "text=Access DENIED Invalid Input. ,reason=47; Invalid Input." Thread-2932 VSValidationEngine.c ERROR "2021-03-22 12:55:36.953 GMT+1100" 172.18.17.254 RADIUS_SCC_ALL:1901 0 0 "text=RADIUS request with unique Id [106_172.18.17.254_46753] has timed-out. Dropping the request. Will be purged." Thread-2960 VSAuthManageAuthnRequests.cpp ERROR "2021-03-22 12:55:39.953 GMT+1100" 172.18.17.254 RADIUS_SCC_ALL:1901 0 0 "text=RADIUS request with unique Id [107_172.18.17.254_46753_] has timed-out. Dropping the request. Will be purged." Thread-2960 VSAuthManageAuthnRequests.cpp ERROR "2021-03-22 12:55:39.953 GMT+1100" 172.18.17.254 RADIUS_SCC_ALL:1901 0 0 "text=RADIUS request with unique Id [108_172.18.17.254_46753] has timed-out. Dropping the request. Will be purged." Thread-2960 VSAuthManageAuthnRequests.cpp ERROR "2021-03-22 12:55:41.954 GMT+1100" 172.18.17.254 RADIUS_SCC_ALL:1901 0 0 "text=RADIUS request with unique Id [109_172.18.17.254_46753] has timed-out. Dropping the request. Will be purged." Thread-2960 VSAuthManageAuthnRequests.cpp ERROR "2021-03-22 12:55:44.954 GMT+1100" 172.18.17.254 RADIUS_SCC_ALL:1901 0 0 "text=RADIUS request with unique Id [110_172.18.17.254_46753] has timed-out. Dropping the request. Will be purged." Thread-2960 VSAuthManageAuthnRequests.cpp ERROR "2021-03-22 12:55:44.954 GMT+1100" 172.18.17.254 RADIUS_SCC_ALL:1901 0 0 "text=RADIUS request with unique Id [111_172.18.17.254_46753] has timed-out. Dropping the request. Will be purged." Thread-2960 VSAuthManageAuthnRequests.cpp ERROR "2021-03-22 12:55:50.955 GMT+1100" 172.18.17.254 RADIUS_SCC_ALL:1901 0 0 "text=RADIUS request with unique Id [112_172.18.17.254_46753] has timed-out. Dropping the request. Will be purged." Thread-2960 VSAuthManageAuthnRequests.cpp ERROR "2021-03-22 12:56:01.956 GMT+1100" 172.18.17.254 RADIUS_SCC_ALL:1901 0 0 "text=RADIUS request with unique Id [113_172.18.17.254_46753] has timed-out. Dropping the request. Will be purged." Thread-2960 VSAuthManageAuthnRequests.cpp ERROR "2021-03-22 12:56:03.956 GMT+1100" 172.18.17.254 RADIUS_SCC_ALL:1901 0 0 "text=RADIUS request with unique Id [114_172.18.17.254_46753] has timed-out. Dropping the request. Will be purged." Thread-2960 VSAuthManageAuthnRequests.cpp ERROR "2021-03-22 12:56:04.957 GMT+1100" 172.18.17.254 RADIUS_SCC_ALL:1901 0 0 "text=RADIUS request with unique Id [115_172.18.17.254_46753] has timed-out. Dropping the request. Will be purged." Thread-2960 VSAuthManageAuthnRequests.cpp ERROR "2021-03-22 12:56:09.958 GMT+1100" 172.18.17.254 RADIUS_SCC_ALL:1901 0 0 "text=RADIUS request with unique Id [116_172.18.17.254_46753] has timed-out. Dropping the request. Will be purged." Thread-2960 VSAuthManageAuthnRequests.cpp   Following was done:   Server rebooted but the issue resurfaced next day. Recreated the service on a different port in Symantec but the issue appeared next day on the new service as the okta profile was still attached. Timeout increased to 120s but it resurfaced again next day. Removed Okta radius profile - fixed the issue, 5 days and counting.   Need to reenable as i want to use multiple auth profiles and really want to use this feature due to people logging in from different domains and using different MFAs. ... View more