About pred-martin

Hello Community! I'm trying to create an admin role that gives a user access to the Monitoring functionality.  But with full access to Monitoring only, they are not able to open the details for each log entry - Detailed Log View. I've granted Privacy access too, but that didn't help. Anyone know what specific access is needed to be able to click on the spyglass for all log entries?   Thanks! ... View more

Hello Community! Occasionally we get "SYSTEM ALERT" forwarded to the mailbox, in regards to failed authentications where there was an attempt using a non-existent user. Is it possible to add more information in these logs? Specifically whether the user tried to log on using the GlobalProtect client, or the portal login page? Which portal was used? Unless you're using different auth profiles for each portal, you're kind of in the dark as to which one was attempted. If not, I'd like to add a feature request 🙂 ... View more

Some of our users are experiencing automatic logon, even if the GlobalProtect is configured with on-demand. In most cases this is just a minor inconvenience, but one of our portals are configured with two-factor authentication, and when they chose "deny", GP continues to try and connect repeatedly. This is however inconvenient, since their users keep getting locket out. It would seem that this occurs after hibernation, and that the OS is trying to "resume" the vpn connection as well(?). Although I've noticed this maybe 1 or 2 times in total on a desktop computer that did not come out of hibernation - I had to kill the application because it would not stop. Has anyone encountered the same issue and/or know of a solution to this? Thanks! ... View more

I'm having trouble authenticating with a second VPN tunnel that I've created. I've created a new Portal and Gateway, almost identical to the previous ones. Obviously with it's own external IP, certificate that fits the given domain. Created a new Zone with a tunnel interface associated with it, which is also connected to a static route with the new GP IP range. From GlobalProtect, I'm getting the following when I start logging: GetHttpResponse()... (T1192) 08/14/14 10:39:46:593 Debug(1787): portal proxyparam is empty (T1192) 08/14/14 10:39:46:593 Debug(1838): IPADDR=vpn._______.com,PORT=443,URL=/global-protect/getconfig.esp,POST=1,PROXY_AUTO=0,PROXY_CFGURL=NULL,PROXY=NULL,PROXY_BYPASS=NULL,PROXY_USER=NULL,PROXY_PASS=****,VERIFY_CERT=0,ADDITIONAL_CHECK=1 (T1192) 08/14/14 10:39:46:593 Debug( 734): Send response to client for request https_request (T1192) 08/14/14 10:39:46:794 Debug(1886): receive pan_msg_ping, 3 (T1192) 08/14/14 10:39:56:673 Debug(1886): receive pan_msg_ping, 3 (T4196) 08/14/14 10:40:03:330 Debug( 407): HipMissingPatchThread: now is 1408005603, last hip check is 1408001201, hip check interval is 3600000 (T4196) 08/14/14 10:40:03:330 Debug( 412): HipMissingPatchThread: wait -820000 ms (T4196) 08/14/14 10:40:03:330 Debug( 434): nSleep <= 0. m_tLastHipCheckEventWakeup is 1408001201, m_dwHipCheckInterval is 3600000, Now is 1408005603. (T4196) 08/14/14 10:40:03:330 Debug( 358): CheckHipMissingPatchInOtherProcess() (T4196) 08/14/14 10:40:03:330 Debug(  63): pan_get_full_path(): full path in multibyte char is C:\Program Files\Palo Alto Networks\GlobalProtect\PanGpHipMp.exe (T4196) 08/14/14 10:40:03:330 Debug( 324): CheckHipMissingPatchInOtherProcess(): Starting process PanGpHipMp.exe (T1192) 08/14/14 10:40:06:705 Debug(1886): receive pan_msg_ping, 3 (T4196) 08/14/14 10:40:08:830 Error( 340): CheckHipMissingPatchInOtherProcess(): Wait timeout for process PanGpHipMp.exe (T1192) 08/14/14 10:40:16:768 Debug(1886): receive pan_msg_ping, 3 (T1192) 08/14/14 10:40:16:768 Debug(2034): HTTP_RPC, len=0, result is (NULL)... (T1192) 08/14/14 10:40:16:768 Error(4279): pszXmlConfig is NULL. 8614 (T1192) 08/14/14 10:40:16:768 Debug(1426): close WinHttp close handle. (T1192) 08/14/14 10:40:16:768 Info (3746): Skip reading cached portal config. (T1192) 08/14/14 10:40:16:768 Debug(3754): portal status is Invalid portal. (T1192) 08/14/14 10:40:16:768 Debug(3755): returns 0. (T1192) 08/14/14 10:40:16:768 Debug(3284): ServerThread: ProcessServerPortal -- return SendResponseToClient(socket, PAN_SERVER_PORTAL) (T1192) 08/14/14 10:40:16:768 Debug(3070): Set state to Disconnected (T1192) 08/14/14 10:40:16:768 Debug( 734): Send response to client for request portal (T4196) 08/14/14 10:40:17:835 Debug( 364): PanGpHipMp.exe exit for checking misssing patches. (T4196) 08/14/14 10:40:17:835 Debug( 362): CheckHipMissingPatchInOtherProcess(): exits. (T4196) 08/14/14 10:40:17:835 Debug( 441): Hip missing patch checking duration is 14 (T4196) 08/14/14 10:40:39:845 Debug( 407): HipMissingPatchThread: now is 1408005639, last hip check is 1408001201, hip check interval is 3600000 (T4196) 08/14/14 10:40:39:845 Debug( 412): HipMissingPatchThread: wait -860000 ms (T4196) 08/14/14 10:40:39:845 Debug( 434): nSleep <= 0. m_tLastHipCheckEventWakeup is 1408001201, m_dwHipCheckInterval is 3600000, Now is 1408005639. (T4196) 08/14/14 10:40:39:845 Debug( 358): CheckHipMissingPatchInOtherProcess() (T4196) 08/14/14 10:40:39:845 Debug(  63): pan_get_full_path(): full path in multibyte char is C:\Program Files\Palo Alto Networks\GlobalProtect\PanGpHipMp.exe (T4196) 08/14/14 10:40:39:845 Debug( 324): CheckHipMissingPatchInOtherProcess(): Starting process PanGpHipMp.exe (T4196) 08/14/14 10:40:45:353 Error( 340): CheckHipMissingPatchInOtherProcess(): Wait timeout for process PanGpHipMp.exe (T4196) 08/14/14 10:40:49:980 Debug( 364): PanGpHipMp.exe exit for checking misssing patches. (T4196) 08/14/14 10:40:49:980 Debug( 362): CheckHipMissingPatchInOtherProcess(): exits. (T4196) 08/14/14 10:40:49:980 Debug( 441): Hip missing patch checking duration is 10 (T4196) 08/14/14 10:41:09:993 Debug( 407): HipMissingPatchThread: now is 1408005669, last hip check is 1408001201, hip check interval is 3600000 (T4196) 08/14/14 10:41:09:993 Debug( 412): HipMissingPatchThread: wait -888000 ms (T4196) 08/14/14 10:41:09:993 Debug( 434): nSleep <= 0. m_tLastHipCheckEventWakeup is 1408001201, m_dwHipCheckInterval is 3600000, Now is 1408005669. (T4196) 08/14/14 10:41:09:993 Debug( 358): CheckHipMissingPatchInOtherProcess() (T4196) 08/14/14 10:41:09:993 Debug(  63): pan_get_full_path(): full path in multibyte char is C:\Program Files\Palo Alto Networks\GlobalProtect\PanGpHipMp.exe (T4196) 08/14/14 10:41:09:993 Debug( 324): CheckHipMissingPatchInOtherProcess(): Starting process PanGpHipMp.exe (T4196) 08/14/14 10:41:15:500 Error( 340): CheckHipMissingPatchInOtherProcess(): Wait timeout for process PanGpHipMp.exe (T4196) 08/14/14 10:41:19:402 Debug( 364): PanGpHipMp.exe exit for checking misssing patches. (T4196) 08/14/14 10:41:19:402 Debug( 362): CheckHipMissingPatchInOtherProcess(): exits. (T4196) 08/14/14 10:41:19:402 Debug( 441): Hip missing patch checking duration is 10 (T4196) 08/14/14 10:41:39:415 Debug( 407): HipMissingPatchThread: now is 1408005699, last hip check is 1408001201, hip check interval is 3600000 (T4196) 08/14/14 10:41:39:415 Debug( 412): HipMissingPatchThread: wait -918000 ms (T4196) 08/14/14 10:41:39:415 Debug( 434): nSleep <= 0. m_tLastHipCheckEventWakeup is 1408001201, m_dwHipCheckInterval is 3600000, Now is 1408005699. (T4196) 08/14/14 10:41:39:415 Debug( 358): CheckHipMissingPatchInOtherProcess() (T4196) 08/14/14 10:41:39:415 Debug(  63): pan_get_full_path(): full path in multibyte char is C:\Program Files\Palo Alto Networks\GlobalProtect\PanGpHipMp.exe (T4196) 08/14/14 10:41:39:415 Debug( 324): CheckHipMissingPatchInOtherProcess(): Starting process PanGpHipMp.exe From the system log in PAN I'm getting: "GlobalProtect portal user authentication failed. Login from: 1.2.3.4, User name: user, Reason: Authentication failed: Invalid username or password , Auth type: profile" Did also recieve one error: "User 'user'' failed authentication.  Reason: User is not in allowlist From: 1.2.3.4" Even though I've defined the user in both the client config for the Portal, including in the authentication profile that the portal is associated with. Anyone have suggestions to what the cause might be? Last time I set up the GP I was instructed, so there's a chance that I've missed a few details. Feel free to ask for more information if needed. Appreciate the help! ... View more

Hi! One of our customers have RDP access to a server, works like a charm. And now I was about to grant access to an application using port 4850 and 4851, but it would seem that this wouldn't be that simple. I've attached the NAT of the working RDP, and the non-working OPC application: (I've also added the newly created application to the existing Security rule that allows RDP.) I want to add that the newly created application has not been given any signatures - only properties, characteristics, timeouts and the ports itself. But even if the application somehow is "wrongly" created, at least the ports should be registered open? Anyone have any clue as to what I might have forgotten, or rather have done wrong? I'll provide more information if needed. ... View more

Hi all! Some of my colleagues have problems accessing certain services like TFS, Intranet, and Office 365(outlook, lync) through VPN. The weird thing is that for others it might work either 100%, 50% or whatever feels right that day, it seems. What could cause this kind of inconsistent behaviour? Appreciate all help I can get. Thanks! ... View more