About pasmartin

pasmartin · ‎09-13-2021

Yeah - feel free to report your results if you manage to get v7.5 installed - nice to know whether I got lucky, or if it's something with 7.2.* / 7.3.* versions that is causing this behavior.

pasmartin · ‎09-09-2021

No, never got as far as creating a ticket as I was swamped with other stuff, and since this PC was not to be used before september (luckily), it was not prioritized until a week or two after I wrote the post. A new version of XDR was available (7.4.0 if I'm not mistaken), and that did not trigger the issues. The version that seemed to be the cause for me was 7.2.2. Which version are you running?

pasmartin · ‎08-08-2021

Our organization has started using Azure AD and Intune for managing PCs, and the enrollment include the deployment of Cortex XDR client. So far, we've had no issues during our (slow but surely) transition. But last week I encountered a strange problem where we got the new Dell Precision 5560 for a new employee. Login with credentials - successfully enroll to Intune, and everything is seemingly fine entering Desktop. Initiate Windows update and a reboot is required. Then when booting and loading Windows, the Dell logo is the last thing we see followed by pitch black screen, and Automatic Repair is kicked off after a few cycles. Safe Boot works, indicating that something is wrong with either drivers, updates or applications. Few hours spent later, I manage to evade the boot problems, and the reason is that I've disabled Cortex XDR client to be automatically installed. At some point, I also tried a manual install which had the same results. Has anyone encountered similar issues? As mentioned, this has worked without problems until now, and the last PC I enrolled was a Precision 5550. Could there be an issue with the new components of the P5560 and its drivers, or is it just a coincidence? Thanks!

pasmartin · ‎06-11-2021

Thanks, @JimmyHolland , but it does not seem he's available. Are there anyone else in the PAN team that might know a thing or two about this?

pasmartin · ‎06-03-2021

@jdelio Oh snap - the PA220 had no check or action for antivirus - but other than that, they are configured the same for app&threat, wildfire are on the same versions.

pasmartin · ‎06-03-2021

Thanks for your reply! Indeed - the PA220 is running 10.0.3, and the PA820 is running 10.0.4 (I know, the PA220 should be the one "on the bleeding edge-SW", rather than the PA820, but haven't found a fitting moment for it yet.

pasmartin · ‎05-27-2021

Hi Community! I have some issues getting HIP checks to work on a PA820. Have configured a couple Objects that checks whether the Cortex XDR agent or Windows Defender is installed/enabled And have them added to a profile that I have added to the GlobalProtect Gateway. This seems to be working fine on a LAB-PA220 - triggers whenever Cortex XDR is not found, or if Defender is turned off. Verified on three separate devices (VM running Windows 10, Laptop running Windows 10, VM running server 2016). On the PA820 however, users get the "Not Match Message" regardless of Cortex XDR / Defender status. The funny part is that on the test machines mentioned above, I'm unable to reproduce the issues my coworkers are seeing. HIP works as intended. Anyone know what could cause this behavior? My guess is that this is due to some local issues on Windows - but could there also be some issues where the firewalls (in general, or PA820 specifically?) are unable to get the the Host Information for some reason? Appreciate any help!

pasmartin · ‎05-27-2021

Hello Community! I'm trying to deploy a Site-to-Site connection between NGFW and Azure Virtual WAN using the automation tool written by vinayvenkat (links below). When running the script as instructed, it errors out while creating IKE Gateway: DEBUG2:pan.xapi:method: POST Traceback (most recent call last): File "panw_ipsec.py", line 482, in <module> main() File "panw_ipsec.py", line 452, in main wan_ip = az_vpn_hndl.vwan_ip0 AttributeError: 'NoneType' object has no attribute 'vwan_ip0' Anyone had the same issue, or can steer me in right direction in correcting this? Appreciated! https://github.com/PaloAltoNetworks/microsoft_azure_virtual_wan/blob/master/PaloAltoNetworksVPNAutomationforMicrosoftAzure.pdf https://github.com/PaloAltoNetworks/microsoft_azure_virtual_wan

pasmartin · ‎06-18-2019

webui { 974 webui { 973 monitor { 975 monitor { 974 logs { 976 logs { 975 traffic enable; 977 traffic enable; 976 threat enable; This is what I have for the admin role when doing a config audit. Am I missing something here? The user is not able to get the detailed logs. This is what devconsole is outputting when clicking a spyglass:

pasmartin · ‎06-17-2019

Hello Community! I'm trying to create an admin role that gives a user access to the Monitoring functionality. But with full access to Monitoring only, they are not able to open the details for each log entry - Detailed Log View. I've granted Privacy access too, but that didn't help. Anyone know what specific access is needed to be able to click on the spyglass for all log entries? Thanks!

pasmartin · ‎06-06-2018

Also, whether it'd be possible to set a variable for "additional recipient" or something like that, that would use the username defined in "opaque: failed authentication for user 'username'", so that both myself and the user in question that failed login, would receive an email about a failed login. For instance - let's say the logs echo opaque: failed authentication for user 'username123' The username stated in each logged entry would be GET'd, and "@domain.com" would be appended and used to notify said user.

pasmartin · ‎06-06-2018

Hello Community! Occasionally we get "SYSTEM ALERT" forwarded to the mailbox, in regards to failed authentications where there was an attempt using a non-existent user. Is it possible to add more information in these logs? Specifically whether the user tried to log on using the GlobalProtect client, or the portal login page? Which portal was used? Unless you're using different auth profiles for each portal, you're kind of in the dark as to which one was attempted. If not, I'd like to add a feature request 🙂

pasmartin · ‎02-28-2018

Will try that out, thanks! Just waiting on a response on the change order first 🙂

pasmartin · ‎02-20-2018

Hello community. Let's say I have an Atlassian Confluence site that needs to be accessed by a user (or multiple) - is it possible to specify down to the URL to only give the user access to a given set of pages? Confluence permissions only allow me to give access to entire spaces. Could be advantageous to allow a general user not tied to a specific person to get access only to a list of URLs in many different spaces, for instance where you would have a consultant or something like that that needs to access some pages spread across the entire space directory. Thanks!

pasmartin · ‎11-06-2014

So we've now tried an older version (2.0.1), and the same issue exist for this one. Except if we do as you mentioned regarding on-demand, SSO and remember me. For each test we used on-demand, and SSO disabled, and it kept logging on - until we removed "remember me". This seems awfully bothersome to make sure it won't logon by itself - turning off 3 "features" to stop it from doing this is not very pleasing :smileysilly: Thanks.

Member Since	‎03-26-2014 12:45 AM
Date Last Visited	‎10-29-2021 05:46 AM
Posts	36

Online Status	Offline
Date Last Visited	‎10-29-2021 05:46 AM

About pasmartin

Re: Cortex XDR client preventing Windows boot

Re: Cortex XDR client preventing Windows boot

Cortex XDR client preventing Windows boot

Re: Unable to deploy PAN->AzureVWAN

Re: Trouble with HIP checks for Anti-Malware

Re: Security flaw with GlobalProtect?

Re: Cortex XDR client preventing Windows boot

Re: Cortex XDR client preventing Windows boot

Cortex XDR client preventing Windows boot

Re: Unable to deploy PAN->AzureVWAN

Re: Trouble with HIP checks for Anti-Malware

Re: Trouble with HIP checks for Anti-Malware

Trouble with HIP checks for Anti-Malware

Unable to deploy PAN->AzureVWAN

Re: Admin roles and Detailed Log View (spyglass)

Admin roles and Detailed Log View (spyglass)

Re: Detailed Logging for attempts externally

Detailed Logging for attempts externally

Re: Security Policy using URLs?

Security Policy using URLs?

Re: Automatic logon with GlobalProtect when settings are set to "on-demand"

Network Security

Cloud Security

Security Operations

About pasmartin