This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About ctr_ts
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About ctr_ts
07-24-2019
10Posts
0Likes
1Solution
Jul 24, 2019Last Visited
User
Activity
User
Profile
Latest posts by ctr_ts
| Subject | Views | Posted |
|---|---|---|
| 21089 | 01-04-2019 01:48 AM | |
| 20900 | 12-27-2018 12:39 PM | |
| 21110 | 12-27-2018 06:01 AM | |
| 3768 | 12-26-2017 10:06 AM | |
| 1516 | 12-26-2017 05:52 AM | |
| 1879 | 02-04-2014 08:15 AM | |
| 3927 | 11-10-2013 08:18 AM | |
| 2502 | 07-13-2012 01:16 PM | |
| 2245 | 06-26-2012 11:37 AM | |
| 2748 | 04-16-2012 06:25 AM |
User Badges
Community Statistics
| Member Since | 03-02-2012 01:26 AM |
| Date Last Visited | 07-24-2019 01:28 AM |
| Posts | 10 |
01-04-2019
01:48 AM
I switched to the latest (head) version of OpenConnect which also supports PaloAlto portal and gateway connection (without the need to enable xauth).
... View more
12-27-2018
06:01 AM
After installing the rpm (latest version as of today: 4.1.7, running on Fedora 28) the cli client cannot communicate with the service (although it is started):
$ systemctl status gpd ● gpd.service - GlobalProtect VPN client daemon Loaded: loaded (/usr/lib/systemd/system/gpd.service; enabled; vendor preset: disabled) Active: active (running) since Thu 2018-12-27 13:19:03 CET; 40s ago Process: 435 ExecStartPre=/opt/paloaltonetworks/globalprotect/pre_exec_gps.sh (code=exited, status=0/SUCCESS) Main PID: 507 (PanGPS) Tasks: 10 (limit: 4671) Memory: 20.9M CGroup: /system.slice/gpd.service └─507 /opt/paloaltonetworks/globalprotect/PanGPS
$ globalprotect Cannot connect to local gpd service.
PanGPI.log says: P1816-T-1080174784 Dec 27 13:25:37:591453 Error( 119): Run GPI into promptDec 27 13:25:37:591454 Info ( 676): debug thread starts P1816-T-1080174784 Dec 27 13:25:37:591489 Error( 80): CPanMsgQueue::create - failed to open message queue. error = 2 P1816-T-1080174784 Dec 27 13:25:37:591508 Error( 51): ConnectToGPA fail with error 2. P1816-T-1100282112 Dec 27 13:25:38:591699 Info ( 682): debug thread ends
Does anyone have an idea what's going on here before I open a support case?
... View more
Labels:
- Labels:
-
GlobalProtect-COVID19
12-26-2017
10:06 AM
Are there any news to this one? Haven't seen any updates, even in PAN OS 8.0 which received quite a lot new IPv6 features...
... View more
12-26-2017
05:52 AM
I would like to edit an existing address object, just changing it's ip-netmask attribute. However, using the supplied examples I can't seem to get a valid URL for changing it. Does anyone have a working example?
... View more
11-10-2013
08:18 AM
Is there an option to have the PA act as DHCPv6 client (DHCPv4 client on an interface is obviously supported)? I get a /56 prefix from my provider and my DSL router offers me the option to assign a /64 prefix via DHCPv6 (IA_PD), but I cannot find an option to make the PA use it (the PA is configured in Layer3 Mode and sits between DSL router and internal network(s)). (If I configure addresses statically however (which would just be a temporary test as I get dynamic prefixes assigned) the PA doesn't seem to advertise the availability of the internal prefix on the upstream interface so that the DSL router doesn't have info how to reach the internal network. But this may be just a configuration problem or lack of IPv6 understanding...)
... View more
Labels:
- Labels:
-
Networking
07-13-2012
01:16 PM
Since link aggregation (LACP or etherchannel) is only supported on PA4000++ I want to build a simple interface-failover / interface-group setup (like any other enterprise firewall allows even on low-end devices). group To do this I would do the following: 1. change interface mode to Layer2 on both interfaces making up the interface-group 2. create a layer2 subinterface each (with same id and vlan tag) 3. associate both to the same vlan 4. enable L3 forwarding on the vlan 5. create an vlan interface and assign it the IP the firewall (on its interface-group) should have 6. connect each port to a different switch 7. enable STP (on switch) 8. cross fingers (with 2. only required when this is a trunk with multiple vlans) It seems to work but is something like this supported?
... View more
Labels:
- Labels:
-
Configuration
-
Networking
06-26-2012
11:37 AM
I have a VPN setup to a destination that using ddns to keep the hostname across IP changes. This works fine as long as the remote end is initiating the tunnel, but it seems the PA cannot be configured to be able to also *initiate* the tunnel: When the remote IKE Gateway is configured to "Peer Type: Static" I could enter an IP address, but since the destination has a dynamic IP this is not an option. When the remote IKE Gateway is configured to "Peer Type: Dynamic" I cannot enter anything (like hostname) anymore, so obviously the PA does not have sufficient information to establish the tunnel although it should be technically possible with Agressive Mode. (Note that the configurable "Peer Identification FQDN" that can be entered in is only for identification purpose and will of course not be used to connect to the destination) Is this a known limitation? Any Feature Requests pending for this? Thanks, Christian
... View more
Labels:
- Labels:
-
Configuration
04-16-2012
06:25 AM
Sorry to hijack this old thread, but I just had the very same question and decided to give it a try anway. Just wanted to share my findings (please note I used Xen.org Xen 4.1 rather than the commercial XenServer, but the current - XenServer 6.0 - Hypervisor is also based on Xen 4.1 so this should be close enough) so far: - Converting the vmdk to raw and then LVM was no problem (using qemu-img as intermediate step and then creating a LV with exactly the same size as the resulting raw file) - Running in PV mode (paravirtualized) cannot work as the kernel has no support for Xen compiled in (although 2.6.32 has mainline Xen domU support, its just not enabled), booting the image off a self-made kernel works, but PAN services do not start due to missing (proprietary) modules (FIPS check?), trying to build a "similar" kernel (that may be able to load PAN modules) cannot work either, as Xen 32bit domU required PAE (highmem) to be enabled. Stock Panaroma modules dont have highmem enabled, so the modules would not be compatible. - Running in HVM basically works when changing the boot disk from sda to hda (again, there is Xen support in the used kernel but no support for it compiled in, so we have to rely on qemu presenting the virtual PIIX controller and the plain ode ATA/IDE driver picking it up). Looking at some files in /boot this used to be a supported scenario (there are two files for every boot option one referencing hda and one sda) but the sda files are active, so one had to manually change that to be able to boot. Even if there were Xen drivers, the block devices would be xvda* rather than sda* Initial config (IP) can be set an Panorama remotely accessed, however I haven't been able to upgrade such a VM to anything other than the base image (4.1.0 -> 4.1.x did not work) with the updater complaining about failed scripts and VM starting in maint mode the next time. I *assume* this is due to the hda/sda difference, but I cannot tell for sure. Overall 99% seems to be there (2.6.32 is recent enough to support Xen without patches, a newer kenerl boots up the image just fine but lacks PAN proprietary stuff), but that single 1% is preventing it from actually being useful...
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
07-24-2019
01:28 AM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks