About cdcirexx

Hi there, What I did was app override for the ports on the mitel, and also under file blocking I created an allow rule for the mitel app to update ... View more

Nope, I've had an open ticket for a month now, TAC has been puzzled by this, even after looking at packet caps, they had me upgrade to pan-os9, they're starting to think nothing's wrong with the firewall and could be something misconfigured or on the mitel side. ... View more

So basically we can get the phones to call in and out but some buttons like the user directory or voicemail has issues, it will say connection failed or connection to server lost when pushing some of those buttons, we're not doing any decryption at this time. Waiting on TAC to follow up, their supposed to run packet captures. ... View more

Thanks for the reply, we tried to bypass decryption, but that didn't work, we're now have other issues on our phones, like we can't get to voicemail, I'm trying to work with tac, but the engr seems to be not sure of what's happening. ... View more

Thanks Bpry for the reply,   Yeah I've told management about the domain part already being secured, but this came up in our meetings cause were going through cyber security compliance right now and their worried of an audit that will come up about how we protect users identity inside of our network. So the idea of having an inside mfa came up. We will not use the token inside, we may use the secureid app, or even a thumbprint reader.   So for the userid mapping, I have that under our inside zone enabled, and I already have a radius server profile setup, I had our tokens fully setup for globalprotect when I started the rsa trial. I'm went through this article when I setup our radius server, that looks like step 6 on your 2nd explanation,  so I can setup a new production group that will trigger as unknown and will be redirected to the captive portal which points to the rsa auth manager server, then these domain users would go through the mfa process. https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/user-id/enable-user-id#   I'll give this a try and we'll see how it works thanks again   ... View more

Hi Reaper, thanks for the reply, I looked up 801.1x pnac, it's similar, but there no guest access, it's all domain users that need to get mfa from the inside vlan that will use radius, Could I use captive portal along with radius for that inside vlan to authenticate domain users? Basically upper management wanted to see how these tokens work from an inside perspective before fully implementing. ... View more