About BDBartlett

Since you are placed on the outside of your current firewall, you will be (are) seeing the traffic after NAT has been performed.  If you want to see the traffic before it becomes NAT-ed, you will have to move the virtual wire inside your current firewall. ... View more

Took a look at that, not the case.  The link above fails on all workstations, they all use flash, and refreshing a couple times always gets it to work.  Majority of other links always work, in fact I have yet to definitively identify another link that behaves/fails similarly - but I do recall over the past few weeks getting this error on occasion, and believe it may be related. When it does fail, traffic logs on the PA show sessions denied due to application http-audio not being allowed.  So I wonder if the application ID engine may somehow be misinterpreting what it's seeing and misidentifying the application somehow?  Thanks for giving it some thought, much appreciated ... View more

Curious about multiple IP addresses, and where they get applied.  I have a /30 link space on my untrust interface (with functioning gateway/portal for Windows machines & specific HIP), so I can't add more there, but I do have plenty of rout-able IP's in my DMZ that I could use.  Possible to create multiple gateways/portals off the DMZ interface using unique IP addresses there?   Any tips would be appreciated. Regards, Brad ... View more

How come I do not see this menu option when logging in with an account that is not local, but has been granted all permissions via admin role? I only see configuration management options when I use the local 'admin' account.  Advice would be appreciated, running 4.1.7 currently. ... View more

Local LAN access (local as defined by the native/underlying IP subnet mask) is configurable on the Cisco IPSec and AnyConnect clients, but with GlobalProtect, it seems as though its built in as a 'feature', and no choice is available to the administrator (I'd really like to hear from PaloAlto tech guys on this - by design?  undocumented?).  Its a form of split-tunneling, allowing only local traffic (defined by subnet mask), and tunneling everything else.  In the case of IP range overlap, or mistakes in local subnet masking, there can be some very interesting/annoying scenarios that crop up. I understand that local LAN access is often desirable by end users, particularly when wanting to print locally while 'in-tunnel'.  The machine itself is no more or less vulnerable to attack (from the local LAN) when it is 'in-tunnel', except of course that it can potentially be leveraged to compromise the protected network in real time.  There is little difference in my mind between a machine that can be compromised when it is not tunneled (assuming you are using the client on-demand) and one that can also be compromised while tunneled.  A compromised system is a compromised system - the protected network is vulnerable in either case - just a matter of degrees.  Windows (or other) firewall can/should be configured (by GPO in MS enterprise networks) to protect any machine that is going to spend any time on the 'dirty' Internet (hotels, airports, starbucks, home, etc), not allowing any connections TO the machine while 'offnet' (off the corporate network) - but I digress. In any event, the admin of the GlobalProtect gateway should be able to choose the operating mode they desire - this is a major shortcoming if there is not that level of control built into the GP client/server, and PA needs to speak to this issue.  Have either of you opened a ticket on this? ... View more