About bnelson

Hi, There is also a resource limitation on the packets per second (~20000 - 25000) that the PA-2000 series hardware can handle, in my experience. 44k is a small packet, resulting in a fair amount of packets per second. What is the total throughput is you increase the packet size to 1500k? Ben ... View more

Jim, GlobalProtect 1.1.7 implements enhanced checks for CA Server Certificates chain-of-trust. This change will cause some existing configurations to become invalid and may result in remote users receiving an error when connecting to the portal, or will not be able to connect if the certificate issue is present on the gateway. Before deploying the GlobalProtect Agent 1.1.7 to users, ensure that the Portal and all Gateway server certificates are valid and that the certificate Common Name (CN) fields match the FQDN or IP address of the portal and/or gateway that uses the certificate. The SSL certificate that you use for the GlobalProtect portal/gateway should have a Common Name (CN) that matches what you configured in the portal settings. For example, if your certificate has the CN of gp.example.com, ensure that your portal configuration lists the gateway as gp.example.com and does not use an IP address and vice versa, otherwise when the GlobalProtect Agent tries to connect it will generate an error specifying that the certificate CN does not match. Additionally, when the certificate is created, the Subject Alternative Name (SAN) must be exactly the same as the certificate's CN. If the certificate uses the CN of the DNS name, ensure that the SAN also uses the DNS name and not the IP address. A mismatch will cause the GlobalProtect Agent to recognize that the SAN is not the same as the CN and will also produce the certificate error. If your certificates are generated by a public certificate authority, then this will be done correctly and you should not have any issues. Refer to the following tech note for details on configuring server certificates: https://live.paloaltonetworks.com/docs/DOC-2020 The workaround is to revert back to Global Protect 1.1.6 which does not check trusted CA. Ben ... View more

@BPERE Sorry, this is not part of the blocking of the https web page. The blocking is still performed by the URL Filtering engine. It does allow the Palo Alto firewall to display the block page rather than a default browser error page. In the URL filtering log it will display the ip:port rather than https://www.facebook.com . Ben ... View more

I have experienced the same issue with block pages and https. From the cli run the following commands: config set deviceconfig setting ssl-decrypt url-proxy yes This blocks ssl pages, but shows ip:port and category as any in the traffic log. Ben ... View more

We use the same Identity certificate for end user devices, for ease of management. We do have detailed instructions for configuring iOS to function with Global Protect, you can download them here:  https://support.paloaltonetworks.com/index.php?option=com_pan&task=dl_tech_doc&filename=GlobalProtect-Config-Apple-iOS-RevB.pdf Ben ... View more

It is unfortunate that we don't have access to the User-ID Agent logs, but not the end of the world. If the logs are still on the firewall, you can log into the cli and view the useridd.log for any errors that may point toward a cause of the frequent disconnects. less mp-log useridd.log This may provide more detail on the disconnects. Ben ... View more

Kal, What versions of PANOS and User-ID Agent are you running? I have seen some weird behavior with older versions of the User-ID Agent running. Could you also provide the debug log from the agent itself? This could shed some more light on the issue. Ben ... View more