About cdcirexx

Hello I found this while searching for the same solution we're asked for our cyber compliance checks, is there any docs I can read on this on the PAN support portal   ... View more

Hi there, What I did was app override for the ports on the mitel, and also under file blocking I created an allow rule for the mitel app to update ... View more

Nope, I've had an open ticket for a month now, TAC has been puzzled by this, even after looking at packet caps, they had me upgrade to pan-os9, they're starting to think nothing's wrong with the firewall and could be something misconfigured or on the mitel side. ... View more

So basically we can get the phones to call in and out but some buttons like the user directory or voicemail has issues, it will say connection failed or connection to server lost when pushing some of those buttons, we're not doing any decryption at this time. Waiting on TAC to follow up, their supposed to run packet captures. ... View more

Thanks for the reply, we tried to bypass decryption, but that didn't work, we're now have other issues on our phones, like we can't get to voicemail, I'm trying to work with tac, but the engr seems to be not sure of what's happening. ... View more

  I see this is an old thread, found it searching, I have a similar setup except I'm on a newer pan-os 8.1.10 and I have a pa820, with the same setup for the radius running on our nps 2012r2 box, I tried to follow the pan docs on setting up https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-new-features/authentication-features/eap-support-for-radius.html and https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/authentication/configure-radius-authentication When I swiched to peap-mschapv2 in the nps and the pa820, I get errors on the system log "GlobalProtect portal user authentication failed Android 9, Reason: client cert not present"  and seem to only work with pap which I wanted to go away with and start using peap-mschapv2.   I'm using a internal CA made cert on the pan, which I installed on the nps server also. I was gonna open a ticket with support but I figured I'd ask here first, thanks in advanced for any pointers. ... View more

Thanks Bpry for the reply,   Yeah I've told management about the domain part already being secured, but this came up in our meetings cause were going through cyber security compliance right now and their worried of an audit that will come up about how we protect users identity inside of our network. So the idea of having an inside mfa came up. We will not use the token inside, we may use the secureid app, or even a thumbprint reader.   So for the userid mapping, I have that under our inside zone enabled, and I already have a radius server profile setup, I had our tokens fully setup for globalprotect when I started the rsa trial. I'm went through this article when I setup our radius server, that looks like step 6 on your 2nd explanation,  so I can setup a new production group that will trigger as unknown and will be redirected to the captive portal which points to the rsa auth manager server, then these domain users would go through the mfa process. https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/user-id/enable-user-id#   I'll give this a try and we'll see how it works thanks again   ... View more

Hi Reaper, thanks for the reply, I looked up 801.1x pnac, it's similar, but there no guest access, it's all domain users that need to get mfa from the inside vlan that will use radius, Could I use captive portal along with radius for that inside vlan to authenticate domain users? Basically upper management wanted to see how these tokens work from an inside perspective before fully implementing. ... View more

Figured it out, our old pa500 was still hooked up on the core switch, your right it was a pan mac address, it was int1/5 of the pa500, I unplugged it and the messages went away. Can't believe I missed that  ... View more

Another thing, that mac address also shows up on one of my cisco sg300 switch that's on another bulding, I had our old unifi ap hooked up to that switch before, I took it down already and tried to clear the arp table on the switch as well. ... View more

About the dhcp, I'm using the built in dhcp on my aruba iap ... View more

Hi otakar, Yes I did show mac all on the 820 it showed nothing, but when I do sh arp eth1/1.60 it shows the ip of my cisco svi int that's connected to the 820 sub-int. But the message about the arp ip conflict still shows on the system log, this started when I removed the physical int for that ip and made it into a sub-int. ... View more

Thanks for the response, yes I cleared arp on my 2 catalyst switches, and on the pa820 as well through cli, also it keeps showing an incomplete address for my wifi vlan address of 172.16.60.xx on the 820, I have an open ticket with support but they can't seem to figure it out too. Should I try and remove the sub interface to see if the messages goes away ... View more