About Hithead

Hi,   check the User-ID Agent logs. May the "User Identification Timeout" value is to low...       Can you please share the User-ID agent settings?   we run this settings for years, without any trouble: <timeout enabled="1" entry-timeout="840"/>     ... View more

how is the portal configured? on-demand? ... View more

hi,   note the time and date when it happens again, collect all logs from the Client (PanGPSupport) and take a look at the PANGPS logs. May you will find something what could cause the issue...     ... View more

hi,   you mean "drop"?..."block" is not available... ... View more

hi,   you can create a custom vulnerability signature to block it. But you have to Wireshark the traffic (down- or upload) with these files. In the pcap you can read out the "file-unknown-body" signature of that file which looks like \x3136977BB061728878688662\x   with this condition you can configure a pattern-match and the action to block the traffic.   More information are available here:   https://live.paloaltonetworks.com/t5/Featured-Articles/Tips-amp-Tricks-Custom-Vulnerability/ta-p/71603   https://live.paloaltonetworks.com/t5/Documentation-Articles/Creating-Custom-Threat-Signatures/ta-p/58569?attachment-id=1097   https://live.paloaltonetworks.com/t5/APIs/Custom-signature-file-upload-blocking/m-p/25448/highlight/true#M650         ... View more

first ssl and web-browsing allowed the traffic until ultrasurf could be detected...   i would suggest to block the url category proxy-avoidance-and-anonymizers ... View more

try to right click on the NIC under device manager and uninstall it with the option "delete the driver software for this device". Then remove GP. Reboot your client and try to install GP again.   Which version you are trying to install? ... View more

set the dhcp options in the registry would not help. the "true" dhcp options are set deep in "netsh". Sorry, but my skills on powershell is not good engough to write you an example.   But please find here http://www.ingmarverheij.com/read-dhcp-options-received-by-the-client/ a ps showing the DHCP options. may you can do some research with this ps script example and find a set command instead of show...     ... View more

what is the upload speed of the server and client site? ... View more

Hi,   How you imagine to build up a Client-VPN connection without any agents? PANOS requires GP for Client-VPN.           ... View more

The PA 2000 series are nightmare. I'm so lucky to get rid of it. Get in contact with PAN. May they can offer a financial solution... I know PAN is also tired to support these appliances... ... View more

  Your best excuse for having a PA2000 series 🙂 ... View more

ssl decryption happens in the dataplane, a dedicated hardware (as i know). at all hardware series, except the PA-200, the traffic operation part (ssl, policy, threat scan...) is separated between the dataplane and management plane (MGT, reports, logging..) ... View more

Hi did you mean this? :   Simplify SSL certificate signing and management process. You can utilize dedicated hardware security modules (HSM) to manage the certificate signing functions for SSL forward proxy, SSL inbound inspection, and the master key storage functions. HSM support is generally required when FIPS 140-2 Level 3 protection for CA keys is required.   Supported HSMs: SafeNet Luna SA and Thales Nshield Connect. Platforms supported: PA-7050, PA-5000 Series, PA-4000 Series, PA-3000 Series, VM-Series and the M-100 management appliance. https://www.paloaltonetworks.com/products/features/decryption.html           ... View more

so far as I know both ideas are not possible or implemented (,yet)...sadly... But what I would try: GP Version 2.3.X is able to run scripts... I'm pretty sure you can add some DHCP options with using a script. Please write your solution - I'm also interested ... View more

hi,   this is (to 99% sure) not a GP problem. In the past (some years ago) we also had a simular problem. Its a client problem.   check this out: http://superuser.com/questions/495759/why-is-ping-unable-to-resolve-a-name-when-nslookup-works-fine http://superuser.com/questions/220471/dns-resolution-issue-nslookup-works-but-web-ping-doesnt http://www.fencepost.net/2009/11/dns-fails-nslookup-works-fix/   I'm sorry but I can't remember the correct solution but may you will find the way 🙂 ... View more

hi,   we also have remote users in china. they don't having problems at all... If (just sometimes) they have problems to conntect is because of the china great firewall: - latency issue and trying to decrypt SSL connections. Workaround: waiting or try another portal.   check how the latency is from the client is, use a newer version of GP and ensure a none decrypted connection... ... View more

the thing is:   the user id agent is reading kerberos(authentication) tickets logs on the DC/AD generated by every client. If the client has two NICs connected, it could happen (as explained) that the generated kerberos ticket includes the wrong IP of the client. But the client is using the other NIC for commuication --> Fail, because the user is unknown for the PA.   If only one NIC is connected, the client is sending just kerberos(authentication) tickets of this IP. So the User-ID will get for sure the correct IP-User mapping.   Just try it out. ... View more

we also had some experience with that.   Clients were connected on both networks and the client was sending kerberos tickets with the wrong ip but using the other interface for traffic. To solve that issue we set our laptops to disable WLAN when connected to wire/docking station. ... View more