About cdcirexx

Nope, I've had an open ticket for a month now, TAC has been puzzled by this, even after looking at packet caps, they had me upgrade to pan-os9, they're starting to think nothing's wrong with the firewall and could be something misconfigured or on the mitel side. ... View more

So basically we can get the phones to call in and out but some buttons like the user directory or voicemail has issues, it will say connection failed or connection to server lost when pushing some of those buttons, we're not doing any decryption at this time. Waiting on TAC to follow up, their supposed to run packet captures. ... View more

Thanks for the reply, we tried to bypass decryption, but that didn't work, we're now have other issues on our phones, like we can't get to voicemail, I'm trying to work with tac, but the engr seems to be not sure of what's happening. ... View more

Thanks Bpry for the reply,   Yeah I've told management about the domain part already being secured, but this came up in our meetings cause were going through cyber security compliance right now and their worried of an audit that will come up about how we protect users identity inside of our network. So the idea of having an inside mfa came up. We will not use the token inside, we may use the secureid app, or even a thumbprint reader.   So for the userid mapping, I have that under our inside zone enabled, and I already have a radius server profile setup, I had our tokens fully setup for globalprotect when I started the rsa trial. I'm went through this article when I setup our radius server, that looks like step 6 on your 2nd explanation,  so I can setup a new production group that will trigger as unknown and will be redirected to the captive portal which points to the rsa auth manager server, then these domain users would go through the mfa process. https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/user-id/enable-user-id#   I'll give this a try and we'll see how it works thanks again   ... View more

Hi Reaper, thanks for the reply, I looked up 801.1x pnac, it's similar, but there no guest access, it's all domain users that need to get mfa from the inside vlan that will use radius, Could I use captive portal along with radius for that inside vlan to authenticate domain users? Basically upper management wanted to see how these tokens work from an inside perspective before fully implementing. ... View more

Thanks for the reply Bpry, we do have threat prevention and app-id on, and had to move any dbase users to the same vlan cause of the slowdowns, so with the pa820 it should resolve that, I actually went and did the import export already to the pa820, and will change the cables at the end of the day to test. ... View more

Hi guys, I'm trying a similar setup, I'm installing a new pa820 replacing our old pa500, but currently the pa500 is acting as a router/gateway to clients and servers, but users are experiencing slow intervlan performance(the pa sub int seems to not run at 1gb wire speed). So I'm making the pa820 have layer2 sub int that will bridge to our layer3 cisco svi int and use the svi int as gateways, I'm trying to find the best plan of attack before making changes, thanks in advanced. ... View more