This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About sitecore
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About sitecore
08-18-2015
17Posts
1Like
0Solutions
Aug 18, 2015Last Visited
User
Activity
User
Profile
Latest posts by sitecore
| Subject | Views | Posted |
|---|---|---|
| 2735 | 10-31-2012 05:11 AM | |
| 2734 | 10-30-2012 11:09 PM | |
| 2820 | 09-27-2012 01:45 AM | |
| 3798 | 09-25-2012 11:16 PM | |
| 7021 | 09-25-2012 04:24 AM | |
| 2406 | 06-27-2012 09:08 AM | |
| 2629 | 06-25-2012 02:14 PM | |
| 2109 | 06-10-2012 12:49 PM | |
| 1737 | 06-07-2012 08:48 AM | |
| 1293 | 06-06-2012 12:49 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 09-25-2012 04:24 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like |
User Badges
Community Statistics
| Member Since | 01-03-2012 05:36 AM |
| Date Last Visited | 08-18-2015 09:07 AM |
| Posts | 17 |
| Total Likes Received | 1 |
10-31-2012
05:11 AM
Sorry to disappoint you - but the above issue is related to the GlobalProtect agent - not the firmware version on the firewall. You can experience the problem they mention on any firmware level if you use GP 1.1.7 We saw the authentication problem on a PA with 4.1.8 (and GP 1.1.7). After downgrading to 4.1.7 (still GP 1.1.7) our VPN client certificate authentication worked again. Br Jørgen
... View more
10-30-2012
11:09 PM
Wohaa. Thanks for that Chris. I was looking at upgrading not). Small warning for people: The 4.1.8 also seems to fail VPN client connection using internal certificates. This might be related to the LDAP issue - not sure thou. Br Joergen
... View more
09-27-2012
01:45 AM
Hi Tom, Confirming that after removing the domain entry I was able to log on with my domain account. The bind section however - will still not populate. It has to be there thou for the authentication to work. So step forward - but not something I will try on my firewalls Br Jørgen
... View more
09-25-2012
11:16 PM
@ Edwin, I would expect this to be a general LDAP issue, because I'm not able to have the LDAP server profile to see the AD correctly. Br Joergen
... View more
09-25-2012
04:24 AM
1 Kudo
Having upgraded our Panorama from 4.1.7 to 4.1.8 - we can no longer use the LDAP user authentication. The user constantly gets "invalid username or password" (same message on the Panorama) - yet this worked without any problems with 4.1.7 On Panorama - one can see that in the LDAP profile - the Base option is never getting populated (dropdown option is only "none" rather than domain name). Is this a new "feature" ? Br JørgeDA
... View more
Labels:
- Labels:
-
Configuration
-
Management
06-27-2012
09:08 AM
Spot on - thanks a lot Br Jørgen
... View more
06-25-2012
02:14 PM
Hello everyone, Our PA's are using the thread prevention system which drops traffic that is trying to exploid vulnabillities, do DoS attacks etc. All works very nice - but it's only affecting the attempt on an individual basis. F. ex. - someone performs a "DNS ANY Queries Brute Force DOS Attack" and gets blocked. But then the same source re-tries shortly after. And again and again. I'm looking for a way to automatically block the source IP for a period of time. Say that source IP 119.147.138.171 gets caught trying to do a "DNS ANY Queries Brute Force DOS Attack". If the source IP does this a number of times - then this IP should be completly blocked for a prolonged period of time - f. ex 24h Now the big question is - how do we do that ? Br Jørgen
... View more
06-10-2012
12:49 PM
Having been jumping on this for a while - I think that I finally have found out what the (/&%(/&¤&% goes on. Fortunately one of our SIP trunk providers allows you to change the codec and ho and below I found that: G711U - works G711A - works GSM-FM - works G729 - DOES NOT WORK !!!!! So. If your provider is using G729 - then this is likely why it doesn't work. You need to have the provider to set G711U/A as prefered codec AND you need to set the G711U/A as prefered codec on the SIP trunk on the 3CX. It seems (according to my test) - that if the provider is set to G729 it doesn't matter what you set - it just won't work. Please let me know if you can confirm my latest finding. Br Jørgen
... View more
06-07-2012
08:48 AM
Hello PAN, It seems to me that in order to have skype working correctly - particually with multi-site PA's with Site2Site VPN tunnels in between - it is nessesarely to enable both unknown-tcp & unknown-udp. At least - all our connection problems / delivery delays seems to go away whit the above allowed. But obviously - allowing "unknown" traffic thru your firewall is not the most obvious solution...... A more soft solution could be if it's possible to define a private application/service where: if client is connected to skype with src.port = x then allow unknown-tcp and unknown-udp where src.port = x Does anyone know if this is possible somehow Thanks Jørgen
... View more
06-06-2012
12:49 PM
Yes - it *should* NAT with the VPN IP. But if I log dropped traffic on the firewall I see: Inbound interface = VPN Tunnel interface Source zone = our VPN zone Source IP = my public IP Destination zone = our internal zone (any of them 🙂 ) Destination IP = internal IP So it is certainly not NAT'ing *all* the traffic. It's a bit of both - which of course cannot be good for performence. Br Jørgen
... View more
06-06-2012
04:33 AM
Hello PAN, Some of our users has a GPAgent on their private computer in case (very rarely) that they suddenly need to be able to connect to the company. For such users - the automatic starting of the services are *extremly* annoying and disturburbing for them (and other family members) and unfortunately this happens even iff the agent is in on-demand mode. How can we configure the GPAgent so there is no services starting so users can just launch the application in case they need it ? Thank you. Br Jørgen
... View more
06-05-2012
10:48 PM
Hello PAN. Trying to figure out why my connection on the VPN client was behaving a bit sporadic I noticed that *some* of the traffic send to the firewall from my GPA was using source IP = my client public IP, rather than my client private IP. So. Some traffic is send with source IP = public IP, some traffic is being send with source IP = vpn IP. VPN client i is tunnel mode, where only traffic to internal systems are being send to the firewall. How can we make sure that tunnel traffic is only using source IP = vpn IP (so that it doesn't get dropped on the firewall) ? Thanks Jørgen
... View more
06-05-2012
10:01 AM
At the moment - this *seems* to be working for us: 3CX v.10 w. SP6, default ports and STUN resolving. We're using the "PBX delivers audio" option. PA-2020 w. software v. 4.1.6, Application version 310-1401, Threat version 310-1401, Antivirus version 760-1045 Incomming NAT rules: Public ip on selected ports (port service) send to 3CX server Outgoing NAT rules: Internal IP to Public IP, Translated IP = Static IP, Bi-directional=no Rules: Allow STUN & RTP to outside from 3CX server Allow selected ports from outside to 3cx server Allow selected ports from 3cx server to outside Allow SIP from phones to 3cx (I'm not entirely sure if you need to allow rtp or selected ports from phones to 3cx server - at the moment it doesn't appear to be needed) Br Jørgen
... View more
05-18-2012
01:45 PM
Hello people, Today we had an issue with a user moving from our old VPN setup to our new GP agent setup. The user kept being unable to connect the agent. The error thrown was 12044. Our setup is validating users w. client certificate against user AD account. It turned out that the cause was a " ' " in the user surname. Once removed and a new user certificate was generated, the user could connect without any hazzle. So watch out for those "special" characters - seems that the GPA is not fond of them. Br Jørgen
... View more
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks