About Sly_Cooper

All,   I amtesting authentication policy for a certain project and was able to test it successfully with basic configuration. I am looking at a config where a single authentication policy could work across multiple vsys.   Scenario,   Firewall with multi-zone, one of the zones with web-server to intercept and redirect to the captive portal (with MFA). After successful authentication, the firewall will allow RDP access for the systems across multiple zone including non-web server zone. I have multiple environments running behind different vsys and would like to have a single authentication which would give access across multiple vsys. Is this possible? If yes then how? ... View more

Hi All,   I have successfully tested Authentication policy using LDAP, MFA (Okta API), SAML and RADIUS (Okta). I am working on the redundancy scenarios wherein if Okta fails, the fallback would be LDAP. I am using RADIUS (Okta) and LDAP in the Authentication Sequence. I am however unable to get the LDAP (Active Directory) fallback working. I am simulating RADIUS(OKTA) failure by configuring the service route to use the firewall traffic interface and then a security policy to block the RADIUS traffic. I can see that the firewall is successfully blocking RADIUS traffic. I however, want it to proceed to LDAP auth and authenticate considering RADIUS unavailability. I am using default-web-form in the auth policy and CP is set to use the authentication sequence. The authentication logs only show Authentication Failure with the RADIUS server events. What am I missing? Will this config ever work? ... View more

I am testing Captive Portal certificate authentication with enterprise PKI and it is not working. I have imported and configured cert profile using the enterprise root CA. When tried from the client machine, the request gets redirected to the captive portal page and asks for the client cert. Nothing happens when I select the client cert from the browser or the connection is reset over time. There are no logs generated under Authentication logs. How can I troubleshoot the issue? The captive portal is setup in a Redirect mode and the firewall intercepts requests and redirect to the required interface for authentication.  If I am using Certificate Authentication, then do I need to still utilize "Authentication Profile" under Captive Portal settings? ... View more

Is it possible to send the logs visible under the "LOGS" menu to external syslog? If yes then how?   Thanks in advance. ... View more

How can I get device group specific policies as well as shared object, object groups etc. from the Panorama. I tried with API browser and cli (with debug cli on) but could not find specific path/command. I have checked the xml running config and can see the path however not sure how to use it and the type of operation. Thanks in advance! ... View more

I have recently upgraded Panorama from 7.1.x to 8.0.8. Although there are no changes and all firewalls are "in sync" for the configuration, the Panorama "Commit" button is Green/Highlighted. Is there anyone using Panorama with 8.0.x and seeing the same behavior? Until 7.1.x, the green/highlighted butting always meant pending config push/non sync devices.   ... View more

We have upgraded Panorama to 8.0.9 and started receiving " threat-exception is invalid " error for one of our AV profile. Some of the threats are missing Threat Name and changed to "Unknown". Even after removing those, I keep on getting error message about " threat-exception is invalid ". Has anyone seen this issue? I remember doing successful commit post Panorama upgrade and all worked as expected. The AV threat profile and exception has been in use for 3+ years without any issues.All our firewalls are running 7.1.x version. Thoughts/Suggestions? ... View more

I am testing MFA with Okta. I have noticed that the firewall. I have configured everything according to one of the videos Palo Alto Networks videos on YouTube. The firewall captive portal redirection is hit and miss for http and https services. When it works as expected, I get the Palo Alto captive portal form where I could login fine with the first factor (ldap auth) however the second auth i.e. MFA is failing. The monitor -> Authentication shows first auth as a success, however, shows "Can't resolve hostname" msg for the second factor i.e. Okta MFA failure. I used the vendor url hostname and the firewall, as well as test host, can resolve it fine.  What am I missing?   > test mfa-vendors mfa-server-profile okta-mfa Target vsys is not specified, mfa-profile is assumed to be configured under shared. {"res":"FAIL","msg":"Couldn't resolve host name"} I am testing the config on a PA-200 running PAN-OS 8.1.0.  ... View more