Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
- Panorama
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- CN-Series
- VM-Series:
- Private Cloud
- OCI
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
- Cortex Xpanse
Security Operations
- Resources
- COVID-19 Response Center
About AndyC_234
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About AndyC_234
7Posts
0Likes
0Solutions
Last Visited
User
Activity
User
Profile
Latest posts by AndyC_234
| Subject | Views | Posted |
|---|---|---|
| 1393 | 03-31-2020 12:29 AM | |
| 35294 | 03-15-2018 08:21 AM | |
| 3014 | 03-15-2018 04:15 AM | |
| 1140 | 03-15-2018 01:31 AM | |
| 35300 | 03-15-2018 01:23 AM |
User Badges
Community Statistics
| Member Since | 03-27-2015 03:35 AM |
| Date Last Visited | |
| Posts | 7 |
03-31-2020
12:29 AM
so the json looks like this:
{"ip":["104.129.193.65","104.129.195.65","104.129.197.65","104.129.193.103","104.129.195.103","104.129.197.103"]}
this is my prototype
age_out: default: null interval: 257 sudden_death: true attributes: confidence: 100 share_level: green type: IPv4 extractor: ip indicator: null prefix: zs source_name: zscaler url: https://ips.zscaler.net/pac/json
but it's showing 0 indicators... any thoughts?
... View more
03-15-2018
08:21 AM
I would enable the debugger on the client, and see why it's not accepting your cerftificate, it will tell you exactly what is wrong. If you right click on your client, you can choose "Collect Logs", open that zipfile and open PanGPS.log. Look for anything related to SSL: (T21656) 03/12/18 15:19:20:667 Debug( 322): Open_SSL_connection: subject '/C=US/ST=West Virginia/L=Charleston/O=xxxxxxxxx (US) Inc./OU=IS/CN=*.xxxxxxx.com'
(T21656) 03/12/18 15:19:20:667 Debug( 326): Open_SSL_connection: issuer '/C=US/O=DigiCert Inc/CN=DigiCert SHA2 Secure Server CA'
(T21656) 03/12/18 15:19:20:667 Debug(1006): Name vpn.xxxxxxxxx.com matches pattern *.xxxxxxx.com
(T21656) 03/12/18 15:19:20:667 Debug( 923): Cert name check of *.xxxxxxx.com succeeded
... View more
03-15-2018
04:15 AM
1) Uninstall the client: Clean out the registry and Program directories: Start -> run -> regedit. Remove the following key - HKEY_CURRENT_USER\Software\Palo Alto Networks Remove the following key - HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks Delete the following folder/directory - C:\Program Files\Palo Alto Networks Run the following command as an administrator from the windows cmd line: sc delete PanGPS 2) Reboot 3) Download and install / test again.
... View more
03-15-2018
01:31 AM
You could have run 8.0.8 and still use GP 4.1, it's not necessary to run 8.1 for GP 4.1, it's backwards compatible up to PAN-OS 7.1 I don't think it's recommended yet to run 8.1 in production, new releases always tend to have a few issues. The same goes for GP 4.1... it looks nice, and I'm sure it will be a great client, but it's not just there yet... wait until GP 4.1.2... I would downgrade the firewall to 8.0.8, and use GP client 4.0.7 for now, despite the interface looks dated, it does not have the problems you describe and it's very stable.
... View more
03-15-2018
01:23 AM
If you have a certificate on your IP; instead of your hostname; you need to change the external gateway FQDN name to the IP and not use fw.relianet.be So change this: gateways {external {list {fw.relianet.be {fqdn fw.relianet.be;priority-rule {Any {priority 1;}} To this: gateways {external {list {fw.relianet.be {fqdn <your IP address>;priority-rule {Any {priority 1;}} A-
... View more
03-15-2018
01:17 AM
been running 8.0.8 for 2 weeks now, no issues so far !
... View more
- Tags:
- or a f
03-15-2018
01:06 AM
So, While testing GP 4.1 I came accross the following issue: As per the admin guide for GP msi deployment, you can deploy the client using the following syntaxes: msiexec.exe /i GlobalProtect.msi /quiet PORTAL=”portal.acme.com” When doing this on the 4.1 client, I had 2 cases where the client installs using "portal.acme.com" as a portal address, but including the brackets! So it ends up in the registry as "portal.acme.com" instead of just portal.acme.com. Obviously the client tries to resolve that, but fails to do so and ends up in a sort of endless loop of trying to connect, which brings me to the 2nd problem I found with msiexec syntaxes. As per the admin guide, you can install the client and change the default "always-on" mode to "on-demand" mode, which we prefer. We want the user to initate the 1st connection manually after installing the client, for various reasons, one being our MFA setup. The syntax to do so is installing the client using the CONNECTMETHOD=”on-demand": msiexec /i GlobalProtect64-4.1.0.msi /quiet PORTAL=”portal.acme.com” CONNECTMETHOD=”on-demand” When doing this on the 4.0.x clients, the client install quietly, and just sits there doing nothing. On the 4.1 client it immediately starts connecting to the portal to get the config, which is not what we want. So it looks like 4.1 is ignoring the "on-demand" parameter, despite it does show up in the registry, albeit it shows "on-demand" in the registry, so we might be dealing with the same brackets problem. Anybody else experience problems using msiexec to deploy the 4.1 client? A-
... View more
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks
