About filipe

I have a very similar problem. I have LSVPN working between 12 PA appliances. All spoke appliances report " SSLMGR certificate ocsp verification failed.Certificate XX status is unknown ". Device>Setup>Session> Decryption Certificate Revocation Settings is all unchecked in both hub and spokes. I'm using self-signed certificate from HUB appliance, configured with OCSP responder following LSVPN instructions. The same certificate has been imported on spokes and since then the LSVPN has been working well, but I keep seeing the error message in all spokes. What should I configure on spokes regarding OCSP to fix this message? Thanks in advance! ... View more

Hello Tmasuda, I believe there was a bug regarding this issue but it has since been fixed. You can try to restrict access to a specific group by going to Global Protect Portal > Client Configuration > User/User Group, find the desired group to which you want to grant access for that specific configuration profile. The image below illustrates the path: I have tested successfully in PanOS 5.0.1 and 5.0.3. Hope it helps. ... View more

Hello, In PanOS 5.0.1 and 5.0.3, I have successfully specified which group has access to GP vpn by setting Client Configuration > User/User Group. Just make sure your group mappings is correctly set. Hope it helps. ... View more

Hello, Try a rule allowing only skype and ssl, destinated to Any, with url filtering blocking everything but allowing *.skype.com in the whitelist, followed by a rule Deny Any/Any. Keep an eye on the monitor tab and try to use skype and see if you can identify what application and destination is being blocked from your test workstation and fine tune the rule. If even then it doesn't work, let us know. Best regards. ... View more

The simplest being deny all access to 'unknown-user' in the "source user" field. That way only authenticated users will be able to gain access to whatever rules you permit whereas any unauthenticated traffic will be dropped. Does that help? ... View more