This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About ccscott
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About ccscott
05-19-2023
23Posts
6Likes
0Solutions
May 19, 2023Last Visited
User
Activity
User
Profile
Latest posts by ccscott
| Subject | Views | Posted |
|---|---|---|
| 601 | 11-01-2022 12:31 PM | |
| 761 | 10-19-2022 06:42 AM | |
| 398 | 10-19-2022 06:40 AM | |
| 803 | 10-11-2022 11:35 AM | |
| 1119 | 10-11-2022 11:30 AM | |
| 896 | 10-11-2022 11:25 AM | |
| 1074 | 04-12-2022 06:03 AM | |
| 2585 | 01-26-2022 12:03 PM | |
| 2615 | 01-26-2022 06:49 AM | |
| 2969 | 01-25-2022 06:55 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 10-19-2022 06:40 AM | |
| 1 Like | 10-11-2022 11:25 AM | |
| 2 Likes | 07-24-2020 03:32 PM | |
| 2 Likes | 05-11-2017 07:15 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 2 Likes | |||
| 2 Likes | |||
| 1 Like | |||
| 2 Likes |
User Badges
Community Statistics
| Member Since | 08-28-2013 02:25 PM |
| Date Last Visited | 05-19-2023 10:16 AM |
| Posts | 23 |
| Total Likes Received | 6 |
11-01-2022
12:31 PM
I think TaC is wrong here. The 2nd link has always worked for me, although I will say I've found it not to work 100% of the time with https traffic. SSL decryption certain does help.
I think this is an issue with 1st level TAC not knowing something.
... View more
10-19-2022
06:42 AM
hard to say without knowing your environment, but what I've done in the past is to make the "spokes" separate vnets. Palo's in their own vnet with peering all the spoke vnets with this one, and using a LB sandwich on each side.
... View more
10-19-2022
06:40 AM
1 Kudo
I believe the fix is planned in 10.1.8 but that is not official.
... View more
10-11-2022
11:35 AM
I second this. the 2nd error I've also seen with Mac OS and a certificate that is older than 825 days or doesn't have a SAN with the fqdn (or ip) of the portal in addition to the fqdn as the CN in the cert.
... View more
10-11-2022
11:30 AM
It depends on your ultimate goal. Personally I usually deploy multiple vnets and that way the traffic between them can be forced through the vm series firewall, even if it it intrazone. Or you could still do it this way and have multiple interfaces zones. Putting all subnets within one vnet is the thing I would not do in this case.
... View more
10-11-2022
11:25 AM
1 Kudo
Was informed that this will be fixed in an upcoming release.
... View more
04-12-2022
06:03 AM
Then why is "source user" a config option? I've had this working before but it no longer works.
... View more
01-26-2022
12:03 PM
TAC case open although I'm not 100% sure my point is getting across, but they are working on it.
... View more
01-26-2022
06:49 AM
I have confirmed this. There is only one decryption policy configured with an action of "decrypt" and decryption logs confirm that my traffic is being decrypted by this specific policy. There is one user group and one HIP profile configured in the rule. I have confirmed that my test linix/mac machines do not match the HIP policy configured in the rule
... View more
01-25-2022
06:55 AM
Anyone doing this? It is configurable in the policy itself but isn't referenced in any documentation. The firewalls seem to ignore the HIP profile configured in the decryption rule when matching/not matching traffic. When I configure the rule to match a hip profile, it never matches correctly on the HIP part. The hip profile is set to match essentially windows clients and decrypt their traffic, but even when I run a mac or Linux client it still matches. I've double checked hip match logs and I'm not accidentally hitting that profile. Based on the config my traffic should not be decrypted but it is as my username is part of a group referenced in the policy. The firewall just seems to ignore that bit of the config. I've opened a support case but do not have any feedback yet.
... View more
- Tags:
- decryption
- hip
06-03-2021
06:37 AM
I've had some luck with the "logon lifetime" config on the GP gateways, although it can be annoying for users who just leave the machine up and actually connected. I know It's not actually the same, but it can force reauth. I think the original poster is best off using the HIP check timeout "Inactivity Logout" and maybe seeing if something else is available down the road feature-wise.
... View more
06-01-2021
11:29 AM
This is my experience with windows endpoints too. They are just to chatty. If the users powers off or closes the lid then yeah they might go "idle". When you refer to license count, what do you mean? As I understand it the global protect license is for the whole box not per user.
... View more
06-01-2021
11:25 AM
Seems like more of a winodws issue, but I'd like to ask, how are most people actually handling ddns updates while clients are on global protect vpn? Non windows dns here.
... View more
06-01-2021
11:23 AM
Posting just to see how this turns out. I can see this in our future.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-19-2023
10:16 AM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks