About GLastra

Hi Dieterb, was your issue solved? if not, would be useful if you can write the Firefox version and the CA certificate information. regards, ... View more

Hi Hithead, I think is gonna be difficult, skype uses a proprietary implementation and doesn't follow any RFC so first of all the PAN firewall needs to decrypt the sesion [if the skype client uses certificate pinning you're  almost screwed] and after that  need to reverse engineering the protocol. useful links, https://support.skype.com/en/faq/fa31/does-skype-use-encryption allow Skype and Block Skype VoIP and file sharing Regards, ... View more

Your workaround seems nice just ping the IPs you can't see in the ARP table, even if they don't respond the ping you should be able to know they MAC address [try it if you don't believe me]. Or if you wanna add complexity log into their default gateway via SHH in perl [maybe it's the firewall] and look for the MAC in they ARP table, as they pretend to get internet access their DG must know their MAC address. Also you can configure Captive portal as fallback option using the radius servers as authentication method. How to Configure Captive Portal How to Configure RADIUS Authentication About the timer could be a security flag just leave a session more than 1 hour, under those cases the captive portal is a good option in order to re-log every hour... ... View more

Ok first let's check your code, is it working? my $cmd = "ssh ssh\@10.40.10.228";  # external command to run, I assume you're using a UNIX in your computer my $line = "show system info";               # Command to run open CLI, " | $cmd ";                           #Executing the external command, in this case SSH login, you cand find more info in the following link but I prefer to use the backstiks http://www.perlhowto.com/executing_external_commands print CLI "$line\n";                               # you have the CLI opened so you just put the command there and print it close CLI;                                             # you close the SSH external session You have a lot of ways to put this working, you can use the Net:SSH module http://search.cpan.org/~schwigon/Net-SSH-Perl-1.37/lib/Net/SSH/Perl.pm And create an script like this one: use Net :: SSH :: Perl ;                                                  #Loading the SSH module my $cmd = shift ;                         #command to execute    my $ssh = Net :: SSH :: Perl -> new ( $host );               #opening the SSH session    $ssh -> login ( $user , $pass );                                   #login into the session    my ( $stdout , $stderr , $exit ) = $ssh -> cmd ( $cmd );   # the output will be saved in the $stdout varaible  If your script is working may be you can try @output = print CLI "$line\n";                                              # @ indicates it's an array Also the easiest one is that you already set up SSH keys betwen the PA FW and your script machine. https://www.digitalocean.com/community/tutorials/how-to-set-up-ssh-keys--2 my @output = `ssh root@1.1.1.1 "which perl"` ; There is more info in the next link http://stackoverflow.com/questions/2848725/how-can-i-ssh-inside-a-perl-script ... View more

What do you want to do? It's already saved in the $line variable. If you want to process it using the same script just use that variable, ... View more

How to Block Traffic Based on Application Filters with an Exception But I strongly recommend to manually fix the applications you want to allow, so you can create application groups may be you add application filters to those groups, such as category, technology, etc. But just allow the applications you need, This document may help you Security Policy Guidelines I also recommend you to create a SSL decryption policy to gain full app visibility How to Implement SSL Decryption Regards! ... View more

The easy way is use a full tunnel (access route 0.0.0.0/0) and control the access to the host and internet using security policies. For example From: specific_users to: DMZ Hosts_needed -> accept From: All users to: Untrust ANY -> accept. Also if you need both, you can follow the next guide. Using Global Protect with One gateway and both split - full tunnel ... View more

If you're not using the management server to reach your LDAP could be a service route issue. LDAP Authentication Fails When Using a User-ID Service Route ... View more

Try using this kb CLI Commands to Status, Clear, Restore, and Monitor an IPSEC VPN Tunnel show vpn flow tunnel-id X, but I'm not sure ... View more

In the pattern you should put the pattern that you see in the packet capture, remember that must be bigger than 7 characters. But the app-user only is going to be detected when you try to log in, if you block the app you just block the login to the user definided in your app. Also you can try putting the rule above that the rule that accept the App-ID, creating custom signatures sometimes can be a headache. Regards, ... View more

Error code: sec_error_reused_issuer_and_serial | Firefox Support Forum | Mozilla Support it's seems to be a problem with  E SET Smart Security . go to the program interface: setup>enter advanced setup>extend web and email tree>choose SSL> at SSL protocol checking choose "Do not scan SSL protocol. then press OK. If you don have ESET maybe its your antivirus, you can try adding the CA to the computer instead the browser. ... View more

If you have panorama in your internal network, you can update the databases from it. Otherwise you either give the firewall internet access or do it manually as @panos says ... View more