This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies. For details on cookie usage on our site, read our Privacy Policy
Do you mean you are setting up GlobalProtect on Palo Alto Firewall, and when you try to access the page: https://<ip-address-of-portal> you get a IIS7 Page? Firewall will not return a IIS7 page. Maybe you have a port forwarding configured which is forwarding your connection to a Windows Server. https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-GlobalProtect/ta-p/58351 Please make sure that your connection is terminating on the firewall. You can check your session on CLI: show session all filter source <ip of your client> (use public IP if accessing from outside) See if there is any NAT happening here.
... View more
I would suspect that there may be some traffic issues. Possibly for those sessions which are already established. I would suggest to give a try with some live traffic. Firewall has to internally create a map of ports and ids to forward the traffic. Also MAC address linked to HA3 ports will change. It is possible that the existing packets or sessions might see some issue during the change. You can assume this to be same as if you change a network port from a standalone to HA or AGG port. If you run into issues with live traffic in your lab, I would suggest open a TAC case to investigate.
... View more
Probing is a mechanism for firewall to verify if a user is still linked to a certain IP address. The LDAP server creates user-to-ip mappings where WMI probing actively verifies a user is still valid. If the probing cache gets too full. Firewall has a limit to how many IPs it can probe at a givem point of time. If the probing interval is too aggressive you have more chances of running into this issue. You can adjust the probing interval to a more appropriate value to avoid this.
... View more
I see a similar issue in the database and looks like its addresses in 8.0. Is it possible to give 8.0.X a try? I woul suggest to open a TAC case so that they can help investigate more and if applicable request a backport in 7.1
... View more
