About Land-Salzburg

hi everybody,   we've installed cortex xdr agent on a terminal-master server which gets cloned for distribution   xdr-agent on master has active connection to cortex-cloud   but cloned servers can't connect...     xdr-log:   2022/05/18T14:32:44.590+02:00 <Info> LVTS41 [3608:5152 ] {trapsd:VerdictService:WfDeferredRequestsTimer:} Calling cloud for 3 WildFire verdicts 2022/05/18T14:32:44.590+02:00 <Info> LVTS41 [3608:5152 ] {trapsd:Communication:WfDeferredRequestsTimer:} No authentication ID - checking if registration is required 2022/05/18T14:32:44.590+02:00 <Notice> LVTS41 [3608:5152 ] {trapsd:Communication:WfDeferredRequestsTimer:} The agent is not registered. Registering with the cloud. 2022/05/18T14:32:44.593+02:00 <Info> LVTS41 [3608:5152 ] {trapsd:AgentIdentification:WfDeferredRequestsTimer:} Stored hardware id is {17300142-0AC2-FECE-D0E6-DEFD980093ED}, calculated hardware id is {17300142-0AC2-FECE-D0E6-DEFD980093ED} 2022/05/18T14:32:44.593+02:00 <Info> LVTS41 [3608:5152 ] {trapsd:AgentIdentification:WfDeferredRequestsTimer:} All checks done, registering 2022/05/18T14:32:44.596+02:00 <Info> LVTS41 [3608:5152 ] {trapsd:AgentIdentification:WfDeferredRequestsTimer:} Registering using agent ID 2022/05/18T14:32:44.597+02:00 <Warning> LVTS41 [3608:5152 ] {trapsd:AgentIdentification:WfDeferredRequestsTimer:} GetCurrentUserInfo returned with error code 0, continue with registration. 2022/05/18T14:32:44.607+02:00 <Notice> LVTS41 [3608:5152 ] {trapsd:Communication:WfDeferredRequestsTimer:/operations/provision/register:} Communication with server is disabled. Replace distribution ID to reconnect. 2022/05/18T14:32:44.609+02:00 <Warning> LVTS41 [3608:5152 ] {trapsd:Communication:WfDeferredRequestsTimer:} Connectivity Error, error_type = 3 2022/05/18T14:32:44.632+02:00 <Error> LVTS41 [3608:5152 ] {trapsd:AgentIdentification:WfDeferredRequestsTimer:} Error registering with the server, error 4. Error data: 2022/05/18T14:32:44.651+02:00 <Notice> LVTS41 [3608:5152 ] {trapsd:AgentIdentification:WfDeferredRequestsTimer:} Registration failed, hardware_id='{17300142-0AC2-FECE-D0E6-DEFD980093ED}' distribution_id='520620aa0360410e9e081a9d38886436' trial_count=170 error=4 2022/05/18T14:32:44.666+02:00 <Info> LVTS41 [3608:5152 ] {trapsd:Communication:WfDeferredRequestsTimer:} Unable to obtain authentication ID, aborting request. 2022/05/18T14:32:44.667+02:00 <Info> LVTS41 [3608:5152 ] {trapsd:VerdictService:WfDeferredRequestsTimer:} Failed calling server with error 307 - treating all 3 verdict(s) as NoConnection 2022/05/18T14:32:44.667+02:00 <Info> LVTS41 [3608:5152 ] {trapsd:VerdictService:WfDeferredRequestsTimer:} No server response for hash '1a9e9ddcdec423fe5fe8c24d4a3cdfa5ae63b2e355dfe2e8d3dc1ac9061c1608' - treating as NoConnection 2022/05/18T14:32:44.667+02:00 <Info> LVTS41 [3608:5152 ] {trapsd:VerdictService:WfDeferredRequestsTimer:} No server response for hash '2d177e445025b0d9421ae293274ccda237991b4522cf496dc9b84dd2b00dc3bb' - treating as NoConnection 2022/05/18T14:32:44.667+02:00 <Info> LVTS41 [3608:5152 ] {trapsd:VerdictService:WfDeferredRequestsTimer:} No server response for hash 'e40d261541fb62362a9b17aef1cf5d639a27623f6fb28d7d35e4e69f81850a6f' - treating as NoConnection 2022/05/18T14:33:46.351+02:00 <Info> LVTS41 [3608:7596 ] {trapsd:SecurityEventService:EcEventCollectionPipeline:} Raising security event from component 0x152, status 0xC0400097. Starting event rule matching... 2022/05/18T14:33:46.351+02:00 <Info> LVTS41 [3608:7596 ] {trapsd:SecurityEventService:EcEventCollectionPipeline:} Security event rules matching result: Match, rule name=DPI-1000000002 2022/05/18T14:33:46.351+02:00 <Info> LVTS41 [3608:7596 ] {trapsd:SecurityEventService:EcEventCollectionPipeline:} Ignoring security event by policy 2022/05/18T14:33:55.864+02:00 <Info> LVTS41 [3608:3104 default[#2]:7] {trapsd:Protection:VerifyAgentStatus:} AuthTokens value doesn't exist - returning empty tokens vector 2022/05/18T14:34:00.483+02:00 <Notice> LVTS41 [3608:7292 AgentOperationalStatusReporterThread:5] {trapsd:Telemetry:AgentOperationalStatusReporter:} Current agent operational status { "antiexploitStatus" : 0, "antimalwareStatus" : 0, "dseStatus" : 0, "edrStatus" : 0, "generalStatus" : 0, "hostfirewallStatus" : 0 } 2022/05/18T14:34:00.485+02:00 <Notice> LVTS41 [3608:7292 AgentOperationalStatusReporterThread:5] {trapsd:Telemetry:AgentOperationalStatusReporter:} Agent operational status - EDR upload statistics EDR upload success ratio : 0 % Last succeeded upload time: N/A Last failed upload time: 2022-05-18T12:32:25.765Z 2022/05/18T14:34:00.502+02:00 <Info> LVTS41 [3608:7292 AgentOperationalStatusReporterThread:5] {trapsd:Telemetry:AgentOperationalStatusReporter:} Waiting for 300 seconds   what is the problem?    is it only possible to install on running-cloned server?    thx for any help   regards ... View more

hi everybody, i've some questions regarding global protect client and mixed environment internal / external   we have a internal campus networking infrastructure with lan and wlan (2 different subnets), so the laptop changes the ip-address if traveling around the campus, wired or unwired...   so we have installed global protect client for internal use without tunnel mode for user-id through palo firewall for internet access...this seems to work..   but now:               users want to connect with global protect from external to campus network, external access is planed with multi-factor-auth                via radius config in global protect   now i've tried several things:   2 portal-config setups (internal and external) because we need 2 different connect methods for global protect on demand with mfa via radius-auth (if user connects external) always on with ldap-auth (if user is on campus network) and 2 gateway-config setups tunnel mode (if user connects external) no mode (if user is on campus network)   is this setup recommended? or what would be best practise?    1 portal and mfa internal + external?   i've seen some strange behaviour with mixed portal config...sometimes client does not connect internal when last connection was external...   maybe someone can help me....   regards, fabian ... View more