About BrandonWright

To clarify, this is for Prisma Access/Global Protect Cloud Service.   Thanks,   Brandon ... View more

Hello Cristiano,   I believe it should work with any variant of the GP client since the RADIUS challenge response stuff is built into all of the clients.   Thanks,   Brandon ... View more

Hello Cristiano,   Make sure that you have EAP type added for PEAP, on the connection policy:   Also ensure you have a condition set for the connection request policy:     Also ensure that after you put the cert and key pair on the RADIUS server that you make sure that's being used by the RADIUS server, and that the profile is set to trust from that CA.  It needs to be in the Machine store I believe:         ... View more

Hello Cristiano,   See the document I've posted here ->  https://drive.google.com/file/d/1_wjjrIILr2akt63ueUIK-xAq9zPwGqWw/view?usp=sharing   Keep in mind that you should use a Windows PKI issued Certificate on the RADIUS server, but I wrote this up since I've run into customers in the past that may not have that infrastructure available.   Thanks,   Brandon ... View more

Something else I've noticed when setting this up, is that the Provider Bundle ID and the Identifier seem to have to match in order for you to successfully install the profile.   ANOTHER IMPORTANT NOTE IS THAT FOR THE ACCOUNT FIELD IN THE APPLE CONFIGURATOR, THE NAME NEEDS TO MATCH THE COMMON-NAME ON THE CERTIFICATE. ... View more

Palo Alto only has this requirment for LDAP Authentication only when managing the device.  You can use a RADIUS server with RADIUS authentication profile to allow management by AD group, and that works fine, so if you have Microsoft IAS, or other RADIUS server, that will work for allowing a group to authenticate to the firewall and/or panorama. ... View more

Hello All,   I spent some time with this problem.   All of the information here is correct, however there aren't a lot of correct examples of using Apple Configurator to generate a .mobileconfig file to install on iOS if using client certificate authentication.  I have found the following guide gets you almost all the way there (Certificates loaded, and vpn profile, but missing the Provider Bundle ID):   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boSUCAY   IMPORTANT NOTE, THE ABOVE DOCUMENT SEEMS TO BE MISSING THE FOLLOWING KEY CONFIGURATION:   On Apple Configurator, there is a Provider Bundle Identifier that needs to have "app:com.paloaltonetworks.globalprotect.vpn" filled in, otherwise the iOS Global Protect App won't use the profile contents.     Hope this helps. ... View more

Hello @BPry ,   So I tried adding a file to the whitelist for the Malware profile under "Examine Office Files with Macros".  This allows the file to open, but as I suspected, A "suspicious process creation" event is still triggered when the macro is run.  This is because in this scenario Excel.exe is starting a child process of schtasks.exe.        You are correct though in your statement about if that doesn't work, you can put it in the "Malware Profile" and allow Excel.exe to launch something like schtasks.exe with very specific parameters.  In the end, it would be allowing Excel.exe as a whole to perform a very specific task, which isn't all that bad.  As an example, I've attached a screenshot of the exception I made for a fictional excel file I created with a macro to set a scheduled task.     Wildcards can be used in the Command Line Params as well.   Thanks,   Brandon   ... View more

Hello @BPry    Thanks for the update on this, I'll give this a try today, and update the post if it works.     ... View more

Hello @BPry,   I don't believe your statement is accurate, you can't really whitelist an excel document file, since as I understand it, Traps protects and evaluates processes/executables on execution, and in the scenario I'm referring to, it would be the Excel.exe process executing and running displaying/presenting a file that has a macro that causes Excel.exe to run a child process that appears suspicious to Traps.  This means Whitelisting the xlsx filename or file hash likely does nothing.   How do you make a child process protection exception to an individual Excel document file?  For example, there is nothing that I have access to that allows me to turn off child process protection on Excel.exe when it is opening a certain file, but does support have this ability?  The reason I'm asking is that  the only option I have is to make an exception to a process name (process name being Excel.exe, which I already know is not a good idea).  I guess to reiterate I was looking for whether it's possible for support to create this type of exception as an Advanced Exception, or is there anyone out there that has had this scenario, and what did they do?   I'm using Traps 6.1 by the way.   Thanks,   Brandon ... View more

For any problems associated with logging into the support portal, or dealing with registered Assets, I would call the support number.  Especially since it looks like you can log in, but aren't associated to the proper account.   https://www.paloaltonetworks.com/company/contact-support   I would use the form based help, or call the technical support line.   Thanks,   Brandon ... View more

Hello Raji,   According to the Docs here: https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/high-availability/ha-links-and-backup-links   " The High Speed Chassis Interconnect (HSCI) ports are Layer 1 Quad Port SFP+ (QSFP+) interfaces used to connect two PA-7000 Series firewalls in an HA configuration. Each port is comprised of four 10 gigabit channels multiplexed for a combined speed of 40 gigabits."   "The traffic carried on the HSCI ports is raw layer-1, which is not routable or switchable; therefore the HSCI ports must be connected directly to each other. The HSCI-A on the first chassis connects directly to HSCI-A on the second chassis and HSCI-B on the first chassis connects to HSCI-B on the second chassis. This provides full 80 gigabit transfer rates. In software, both ports (HSCI-A and HSCI-B) are treated as one HA interface."   Since the newer hardware which contains the HSCI ports is probably very similar, I would assume the HSCI ports are QSFP ports, but again, the traffic on them is transferred via L1, so its not really an Ethernet transport between the devices.  That said, if these devices are in 2 different geographic locations and thus can't be connected via a DAC cable, or 40 Gig QSFPs with Fiber, I would assume you'll have to settle on utilizing a Data Plane port for HA2.   Thanks,   Brandon ... View more

Hello Raji,   I may have been incorrect in the previous post.  There is some information in another post that seems to imply that an AE for HA2 is ok. See this post by @reaper  https://live.paloaltonetworks.com/t5/General-Topics/PA-5220-HA-Configuration/m-p/277657#M75478   Thanks,    Brandon ... View more