This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About gvyskocil
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About gvyskocil
04-28-2023
17Posts
0Likes
1Solution
Apr 28, 2023Last Visited
User
Activity
User
Profile
Latest posts by gvyskocil
| Subject | Views | Posted |
|---|---|---|
| 210 | 04-28-2023 02:06 PM | |
| 2072 | 06-02-2021 10:23 AM | |
| 2223 | 05-21-2021 12:12 PM | |
| 2711 | 03-09-2021 04:11 PM | |
| 3061 | 03-03-2021 03:11 PM | |
| 3133 | 03-02-2021 07:03 AM | |
| 3377 | 02-26-2021 01:32 PM | |
| 2802 | 09-25-2020 10:43 AM | |
| 2891 | 09-17-2020 05:48 AM | |
| 857 | 12-23-2019 08:16 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like | |||
| 1 Like | |||
| 1 Like |
User Badges
Community Statistics
| Member Since | 07-08-2015 01:38 PM |
| Date Last Visited | 04-28-2023 07:27 PM |
| Posts | 17 |
04-28-2023
02:06 PM
I was reading about disconnect at idle being removed and just inactivity logout will be used in 10.1. In the past this never really worked as the tunnel was never truly "idle" unless the end user lost their internet connection or network port was powered off during a shutdown/sleep. Would like to disconnect users who are not actively using their connection. Is that possible now or still a no-go on globalprotect tunnels?
... View more
06-02-2021
10:23 AM
Thanks for the replies. I guess I was confused on the setup for decryption. For outbound I thought I needed to configure SSL forward proxy and best practice is to use a enterprise CA as forward trust certificate. As both posters noted, that is a internal enterprise CA, not a public one as I though I might use. Or I can just use self signed certificates from the firewall. Then it looks like I need a different certificate for a forward untrust certificate. I will probably just use self signed on both for now. I was getting confused as inbound traffic is part of web traffic but looks like the key is the session itself starts as outgoing. The traffic only starts when an internal user requests an external website and I need to look at that as outbound. SSL inbound inspection would be if I have some internal server that people access from outside? For that part can I use the wildcard cert? I have a public cert that server uses for TLS that I am looking at switching to the wildcard cert. Thanks again for the replies. I think I am getting a better understanding of this now.
... View more
05-21-2021
12:12 PM
I recently setup a backup internet provider and bought a wildcard cert instead of renewing our previous cert. Previously just had a cert for remote.mydomain.com we used for globalprotect from network solutions. I have external DNS A records set for remote.mydomain.com with an ip from our main provider. I also set up an A record for remote2.mydomain.com with an ip from the backup provider. I have not created any automatic failover for GP. I was looking at just manually have GP users change to the secondary portal if our main goes down. I have seen some articles when doing this without a CA but not sure on the exact procedure when using a CA for the wildcart cert. I also have certs generated by the firewall I used as the trusted root cert and SSL decryption certs. I was hoping to use the one wildcard cert for all of these now. I recall having an issue in the past because I believe network solutions also has intermediate certs I needed to account for. Looking for pointers if anyone has been through a setup like this before. Thanks in advance
... View more
03-09-2021
04:11 PM
Thank you. I don't have S2S but I do have one DMZ for a server with a public IP address. So I believe I can follow your solution. I do need one PBF to route the backup traffic through ISP2 but I don't care if that is down for awhile so don't need to worry about path monitoring on that one.
... View more
03-03-2021
03:11 PM
Thanks for the info. One question I have on setting up two VR's. I have ethernet1/2 as our inside interface connected to my switch stack. Since an interface can only be in one router how do I set up the internal route. Do I do a second interface on the firewall also connected to the switch stack?
... View more
03-02-2021
07:03 AM
thanks for the suggestions. We already have external DNS setup and unfortunately use the @ A record for our externally hosted website. I can add another A record for say remote2.mydomain.com. I would not failover automatically but then users could use that one if our regular goes down. That is assuming that I can setup a second portal/gateway on the firewall as a backup
... View more
02-26-2021
01:32 PM
I have been reading up and still trying to wrap my head around the exact setup I need. Current ISP1 - use for all LAN traffic out including IP phones. Use global protect also. Have external DNS setup so remote.mydomain.com goes to this ip address. Still want this ISP used for all traffic unless it goes down ISP 2 - I have one backup server that offloads to azure I want to use on this link. Traffic bogs down our main link. So here is the final setup I am trying to configure. I have a PA-820. ISP 1 - all traffic (except for backup server) including global protect should use this ISP. This is on interface 1 ISP2 - backup server traffic only unless a failover occurs. I have connected this to interface 7 So sounds like with global protect I need two virtual routers to insure all the traffic stays on isp 1. My present tunnel is in the L3-inside zone. Not sure if I need to change that. First PBF will be for the ISP1 traffic to failover to ISP2 if it loses the ping to outside. Then I need another PBF to send the backup server traffic out isp2. I also think I need to NAT the server traffic from the L3-inside to the new L3-outside zone I created for isp2. I think this link describes a lot of what I need. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClJeCAK If I treat the LAN traffic in the example as my backup server traffic I think that may work. Suggestions or other good links that describe something similar to my situation? Thanks, V
... View more
09-25-2020
10:43 AM
shows application google-base with an action of block-url for the url www.google.com/search. I had support take a look at it with me and they are not sure what is causing it. They believe something with the PC since it is only happening with one user. It's strange though, as long as you are using the same tab, the same search when done a second time works. Create a new browser window or tab and the first one is blocked. Subsequent search in that tab/windows work fine.
... View more
09-17-2020
05:48 AM
I have an issue that seems to only be affecting one user. They seemingly randomly get the block page when doing a google search. Looking at logs most searches are allowed but then I will see the occasional block-url. I think I have narrowed it down to when chrome is opened the first search fails. Searching after that works ok. If I open a new chrome tab then gets blocked again on the first search. The home page is set to google.com. I tried explicitly setting it to https://www.google.com but same result. Any idea why just the first search is getting the block?
... View more
12-23-2019
08:16 AM
My bad. Looks like the update came out over the weekend. All good now.
... View more
12-23-2019
07:52 AM
My ticket was escalated up to a Palo Alto engineer and there is an issue causing this in the global protect IOS app 5.1.0. They are addressing it and a fix should be coming in release 5.1.1.
... View more
12-18-2019
12:08 PM
Sorry should have noted that post. I did run it and sent that into support also. How exactly is the command formatted using the /steve for instance. I could not get that part to work. There are still some decryption errors in the GP logs from the iphone so that might still be the issue. Thanks for your assistance.
... View more
12-18-2019
08:28 AM
I was able to find our original cert package and loaded all those into my iphone. The remote.mydomain.com cert now shows verified. Still getting the same issue though. Looking at system logs I get auth-success RSA globalprotectportal-auth-succ GP-Portal globalprotectportal-config-succ GP-Portal auth-fail Active Directory failed authentication for user 'my.user' Reason: Invalid username/password. auth profile 'Active Directory' globaprotectgateway-auth-fail Gateway1-N globalprotect gateway user authentication failed We use one port as the gateway and the portal. I am now going through a document sent to me by support for the cert setup so going to look at testing out a new setup. My question for the community is can people connect using a iphone and the globalprotect app 5.1.0. When we were using the 5.0.9 app with the same setup as now it was working fine. I can also connect fine from a PC using the same credentials that fail on an iphone.
... View more
12-17-2019
09:07 AM
OS 8.1.10 Two factor authentication with RSA Secureid and LDAP It appears to be a cert issue. Previously it was working fine. Have a cert from network solutions for the site remote.mydomain.com that is the vpn. It appears to want a trusted root CA.
... View more
12-17-2019
08:05 AM
Is anyone else having issues with the new version? Getting authentication errors. Was working fine before the update. I don't believe anything else has changed. Have a ticket in but was curious if anyone is running 5.1 successfully on an iphone.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-28-2023
07:27 PM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks