This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
- Panorama
- AIOps for NGFW
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- Cloud NGFW for AWS
- CN-Series
- VM-Series:
- Private Cloud
- OCI
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
- Cortex Xpanse
Security Operations
- Resources
About ccscott
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About ccscott
05-15-2022
17Posts
3Likes
0Solutions
May 15, 2022Last Visited
User
Activity
User
Profile
Latest posts by ccscott
| Subject | Views | Posted |
|---|---|---|
| 177 | 04-12-2022 06:03 AM | |
| 788 | 01-26-2022 12:03 PM | |
| 818 | 01-26-2022 06:49 AM | |
| 898 | 01-25-2022 06:55 AM | |
| 772 | 06-03-2021 06:37 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 07-24-2020 03:32 PM | |
| 2 Likes | 05-11-2017 07:15 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 2 Likes | |||
| 1 Like | |||
| 2 Likes |
User Badges
Community Statistics
| Member Since | 08-28-2013 02:25 PM |
| Date Last Visited | 05-15-2022 12:24 AM |
| Posts | 17 |
| Total Likes Received | 3 |
04-12-2022
06:03 AM
Then why is "source user" a config option? I've had this working before but it no longer works.
... View more
01-26-2022
12:03 PM
TAC case open although I'm not 100% sure my point is getting across, but they are working on it.
... View more
01-26-2022
06:49 AM
I have confirmed this. There is only one decryption policy configured with an action of "decrypt" and decryption logs confirm that my traffic is being decrypted by this specific policy. There is one user group and one HIP profile configured in the rule. I have confirmed that my test linix/mac machines do not match the HIP policy configured in the rule
... View more
01-25-2022
06:55 AM
Anyone doing this? It is configurable in the policy itself but isn't referenced in any documentation. The firewalls seem to ignore the HIP profile configured in the decryption rule when matching/not matching traffic. When I configure the rule to match a hip profile, it never matches correctly on the HIP part. The hip profile is set to match essentially windows clients and decrypt their traffic, but even when I run a mac or Linux client it still matches. I've double checked hip match logs and I'm not accidentally hitting that profile. Based on the config my traffic should not be decrypted but it is as my username is part of a group referenced in the policy. The firewall just seems to ignore that bit of the config. I've opened a support case but do not have any feedback yet.
... View more
06-03-2021
06:37 AM
I've had some luck with the "logon lifetime" config on the GP gateways, although it can be annoying for users who just leave the machine up and actually connected. I know It's not actually the same, but it can force reauth. I think the original poster is best off using the HIP check timeout "Inactivity Logout" and maybe seeing if something else is available down the road feature-wise.
... View more
06-01-2021
11:29 AM
This is my experience with windows endpoints too. They are just to chatty. If the users powers off or closes the lid then yeah they might go "idle". When you refer to license count, what do you mean? As I understand it the global protect license is for the whole box not per user.
... View more
06-01-2021
11:25 AM
Seems like more of a winodws issue, but I'd like to ask, how are most people actually handling ddns updates while clients are on global protect vpn? Non windows dns here.
... View more
06-01-2021
11:23 AM
Posting just to see how this turns out. I can see this in our future.
... View more
07-24-2020
03:32 PM
1 Kudo
The basic pre logon KB article is very dated at this point and isn't clear on certificates. Support usually doesn't want to mess with pre logon cases and just refers us to the same dated KB article.
... View more
07-07-2020
05:54 PM
So I get this error too, but on Centos Oddly enough I don't get this certificate error with connecting to the same gateways via another portal. The main differences is the other portal has a GP license, which according to support is not needed. No other OS has the issue.
... View more
12-28-2018
06:17 PM
Also getting this error on RHEL 7 btw
... View more
05-11-2017
07:20 PM
I've always been afraid of this product and honestly trust my own scripts more. Why? Because the docs for it are too high level and don't give me enough detail on how configs are merged, replaced, overwritten, etc. I need to know exactly what will be pushed but its all so cryptic, especially for those of us that didn't start off managing our firewalls with this tool. All I want is shared object management for the most part. I would use Panorama if it had a juniper-style | compare instead of what Palo has in the GUI and if there was a commit-confirm rollback.
... View more
05-11-2017
07:15 PM
2 Kudos
Honestly I would say Palo TAC has taken a big nosedive recently. Seems like all the frontline employees either just stall or are purely gatekeepers. I don't use support often, just when something isn't behaving as documented, but more often than not recently I've been ver disappointed.
... View more
02-27-2014
06:58 AM
I have no problem creating a no captive portal policy for certain servers and workstations. But we have quite a few macs that are not on the windows domain and the ones that are are not logging their ip/username combination for the firewall to learn from AD. Most windows users should be doing this through wsus server anyway. But the main issue is that the application identification is not working well enough for these apps to permit them through unless ssl/other application is also enabled for any user through basically a permit any any policy at the bottom of the rule base. This kind of goes against the postive enforcement approach that Palo Alto encourages. In fact it is much easier to block an app as you basically have to only break one part of it whereas you mush be able to identify and enable all flows/traffic with the postive enforcement approach. I'm very impressed with PA firewalls in general. We use then in a few spots in our network already and are moving to them for our main enterprise firewall (I'm testing all of this on a test PA=5050 unit by the way). I have an SE working with me on this and if I were on a supported unit would just submit a ticket with support.
... View more
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks