This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About nwsol
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About nwsol
06-19-2023
11Posts
5Likes
1Solution
Jun 19, 2023Last Visited
User
Activity
User
Profile
Latest posts by nwsol
| Subject | Views | Posted |
|---|---|---|
| 5557 | 10-05-2015 07:53 AM | |
| 12591 | 10-05-2015 06:42 AM | |
| 9401 | 10-05-2015 04:59 AM | |
| 9405 | 10-05-2015 04:33 AM | |
| 9704 | 10-05-2015 02:05 AM | |
| 9709 | 10-05-2015 01:44 AM | |
| 2236 | 10-05-2015 12:38 AM | |
| 5583 | 10-05-2015 12:31 AM | |
| 11786 | 10-05-2015 12:19 AM | |
| 4230 | 11-26-2012 12:42 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 10-05-2015 07:53 AM | |
| 1 Like | 10-05-2015 06:42 AM | |
| 3 Likes | 10-05-2015 12:31 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 6 Likes |
User Badges
Community Statistics
| Member Since | 07-19-2012 03:46 AM |
| Date Last Visited | 06-19-2023 08:02 AM |
| Posts | 11 |
| Total Likes Received | 5 |
10-05-2015
07:53 AM
1 Kudo
@ITCMPHC wrote: Eventually we unchecked the "Block unsupported cipher suites" in the decryption policy in hopes of allowing these sites to still work but just not be decrypted. Unfortunately in 6.x, this setting appears to be bugged and the site still won't load. Same here. We also configured that setting that way, just to find out it doesn't do anything. Also we have lots of issues with decryption that randomly stops working. Without anything showing in whatever log is reachable from outside. We opened cases in the beginning, but you start giving up after hearing "they can't find anything" for the 5th time or so. We are busy upgrading to 7.0.2 hoping to stabilize things, but that hope is fading...
... View more
10-05-2015
06:42 AM
1 Kudo
Recreating the RADIUS server profile did the trick. (actually, changed the timeout and retry from 3 to 2 and pushed from panorama). The system log now says it switched to PAP for that radius server. That's a nasty bug... Never would have tought 'touching' the radius config could fix the issue...
... View more
10-05-2015
04:59 AM
Yes, The NPS settings are exactly the same as on your screenshot. I also see you're running windows server 2012. Maybe 2012 does not reply on CHAP requests triggering a timeout, while 2008 replies with an access-reject?
... View more
10-05-2015
04:33 AM
We're using it for admin access on PAN-OS 7.0.2. NPS logs give an error (19): No reversibly encrypted password is stored for the user account. This means you should enable reversible encryption on you domain controllers with the policy setting "Store password using reversible encryption for all users in the domain" which is not something we can do. Packet captures show only 1 request and an ACCESS-REJECT radius reply from NPS (because of the CHAP). So no second attempt by the firewall.using PAP
... View more
10-05-2015
02:05 AM
Oh, so you are running the windows 2012 version of NPS? We're running it on 2008 R2. It might be there's a behaviour change between the 2 windows versions.
... View more
10-05-2015
01:44 AM
What are the settings of your policy? I've enable only PAP as an allowed authentication method. I can't figure out how to trigger the PAP failover on palo alto. It keeps on using CHAP which isn't supported on our domain.
... View more
10-05-2015
12:38 AM
Similar issues here. Usually we see that a first visit to a page is not decrypted but subsequent visits are. Also the fact that PAN-OS doesn't support Diffie-Hellman ciphers and sites massivly switching to then, we are left in a situation were we are trying to keep up with adding them to our exception list. So far for "insight" and "visibility"
... View more
10-05-2015
12:31 AM
3 Kudos
We are having the same doubts about pan-os. Every week we have to exclude sites from decryption because they switched ciphers and now only accept DH ciphers. Slowly but surely this renders palo alto's decryption functionality useless. We were hoping for palo alto to catch up with version 7.0, but their SSL decryption remains flawed (and not only the supported ciphers part).
... View more
10-05-2015
12:19 AM
Has anyone managed to get authentication on PAN-OS 7.0 working with microsoft NPS servers? Since version 7.0 authentication against our microsoft NPS radius servers is broken. Because the firewall now always first tries CHAP instead op PAP (see this article) and microsoft NPS always replies with a ACCESS-REJECT massage (see this article -> item 9). As it's insane to start storing our AD credentials with reversible encryption I guess microsoft NPS isn't compatible anymore with Palo Alto? Or am I missing something here?
... View more
11-26-2012
12:42 AM
So, the pre-logon user value is linked to global protect? I indeed found it in the admin guide under global protect. But there's no mention about the two things being linked.
... View more
11-25-2012
11:52 PM
Hi, Can anyone explain what the option "pre-logon" means as a value for source-user in a security policy? I can't find anything about it. Not in the build in help, the admin guide nor the CLI reference.
... View more
Labels:
- Labels:
-
Configuration
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks