Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About JimMcGrady
About JimMcGrady
Announcements
ATTENTION: LIVEcommunity has updated the login experience. This may include a slight change in your sign in process. Please contact community@paloaltonetworks.com with any inquiries.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
2 weeks ago
I'd like to setup a GP environment with a single portal, but two different locations (gateways?) where clients can connect. The documentation talks of gateways and satellites. I'm uncertain of the differences and when you would choose one or the other. Can someone clarify? Thanks.
... View more
3 weeks ago
Global protect has the handy feature of excluding select destinations from being sent over the vpn. For example, setting ( Split Tunnel - Domain and Application - Exclude Client Application Process Name ) https://docs.paloaltonetworks.com/globalprotect/4-1/globalprotect-app-new-features/new-features-released-in-gp-agent-4_1/split-tunnel-for-public-applications Can this feature make use of Windows environment variables such as LOCALAPPDATA? Some apps install in the user's path rather than in a user-independent path. .
... View more
3 weeks ago
It is https (ssl) traffic. I am not decrypting. However i would have thought the rule would match on URL rather than on content. This is the procedure i have followed https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClJKCA0
... View more
3 weeks ago
On my PA 9.1.0 firewall, Ive created a custom URL category 'Akamai' with a url list comprising *.deploy.static.akamaitechnologies.com In my security policy i have a rule allowing any source (trust zone) to reach any destination (untrust zone) via any protocol and any application. The rule specifies 'Akamai' under the Services/URL category. log and allow is set. Any ideas why my rule is not matching? I see likely traffic falling through to a later rule.
... View more
02-26-2020
12:08 AM
The documentation seems a bit light on detail. I have created a Service Principle in Azure and entered the data into my two firewalls as per these documents: https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/set-up-the-vm-series-firewall-on-azure/configure-activepassive-ha-for-vm-series-firewall-on-azure https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal The firewalls validate successfully. However, during failover, the secondary IP addresses dont move. Should there be some config on the firewalls to say "move secondary IP addresses of interfaces A, B, C, and move public IP"? Would there be corresponding config within Azure? How does the system know which interfaces need their addressing changed?
... View more
02-03-2020
11:20 PM
1 Kudo
Its disappointing that the available reporting for Globalprotect is so clunky. I would have hoped we could create a custom report that would pull client IP, username, and auth successful/not. As the System log isnt available in custom reports, this is problematic.
... View more
01-08-2020
09:17 PM
1 Kudo
My Azure subscription will be hosting public websites. Azure handles the translation between the assigned public and private IP addresses for each website. My question concerns routing. Say i have a VM 10.1.1.10/24. The 10.1.1.0/24 subnet has a UDR which will send internet-bound traffic out through my Palo. But where can i assign a UDR for inbound traffic from internet to 10.1.1.10? Currently Azure will route it directly. Can i apply a UDR somewhere to route inbound traffic via my Palo?
... View more
01-08-2020
12:12 AM
It turns out that all of the public to private address translation is done by Azure. The firewall need only be configured with private ip addressing and routing.
... View more
01-07-2020
10:54 PM
I'm having a similar issue. For the untrust (internet facing) interface, shouldnt it be using the assigned public ip and have x.x.x.1 (public IP) set as its next hop static route? EDIT: looking through the palo deployment guide, its says the following regarding the untrust interface: On the IPv4 tab, select DHCP Client. if you plan to assign only one IP address on the interface—the firewall will automatically acquire the private IP address assigned in the ARM template. If you plan to assign more than one IP address, select Static and manually enter the primary and secondary IP addresses assigned to the interface on the Azure portal. Why would this specify 'private' ip address? Being the internet interface, shouldnt it be using the public assigned address?
... View more
12-10-2019
11:26 PM
When a client uses a version (4.1.13) different to what is available from the gateway, they see a popup prompting them to upgrade/downgrade. How would I go about turning off this popup?
... View more
- Tags:
- globalprotect
11-17-2019
10:29 PM
I'm looking at an old version 7 PA3000 which uses a user-id agent to map users (active directory) to IP addresses. When i log onto the firewall CLI a "show user ip-user-mapping-mp all" command returns what looks to be a valid list of user mappings. However 90% of the traffic log entries have 'source user' blank. There doesnt seem to be a reason why the remaining 10% are displaying correctly. Some clients from a given subnet passing through a rule are identified and others arent. Any troubleshooting suggestions would be appreciated.
... View more
08-26-2019
10:41 PM
1 Kudo
If internal host detection is configured, and not internal portals/gateways are defined, will the GP client simply stop trying to establish vpn? Thats what i'd like to see.
... View more
09-13-2018
11:15 PM
I get the same message when i try to install software from Panorama (8.0) to a PA-3000. It sits for several minutes and eventually says failed to upload image. A tail of the log on the firewall shows: 2018-09-14 14:06:49.579 +0800 start a new download 2018-09-14 14:06:49.579 +0800 Starting URL xfer: (v4)https://172.21.1.4:28443/dl.get, (v6), cookie: panjob=5097010//001801045974, data: uri=/download/sw-images/PanOS_3000-8.0.12 2018-09-14 14:06:49.580 +0800 Done xfer handler. rc=0 2018-09-14 14:06:49.580 +0800 Deployment download using service route: 2018-09-14 14:06:54.629 +0800 download_progress for current job 2018-09-14 14:06:54.629 +0800 URL xfer progress: uri=/download/sw-images/PanOS_3000-8.0.12, status: 0 2018-09-14 14:06:54.629 +0800 curl thread state (16:Device or resource busy) 2018-09-14 14:06:54.629 +0800 Done xfer handler. rc=0
... View more
09-13-2018
07:44 PM
The only type of external dynamic list i appear to be able to specify in my firewall policy is a dynamic IP list (not a dynamic domain list). And the formatting of such lists appears to be purely for IP addresses. So my question is, how can i specify fully qualified domain names in a dynamic list usable in a firewall policy?
... View more
06-17-2018
06:39 PM
Many custom reports take ages to complete (if at all) even on version 8.1.2
... View more
- Tags:
- st
03-15-2018
09:20 PM
"Palo Alto Networks - High-risk IP addresses: This list includes IP addresses that have recently been featured in threat activity advisories distributed by high-trust organizations" Is there a list of these high-trust organizations available?
... View more
03-13-2018
01:30 AM
Palo seems fussy about non-displayed characters in the text file. Even the use of carriage return and line feed, as it differs between Windows and Unix text file variants, can mess it up.
... View more
03-16-2017
09:28 PM
3 years later, does Palo have a cleaner way of doing this very common requirement?
... View more
07-07-2016
01:38 AM
Was this issue fixed in 7.0.5+ ?
... View more
07-03-2016
10:06 PM
I've imported a certificate into my Palo 3020 (7.0.2) successfully. However when i select the dropdown field for 'certificate' when creating an SSL/TLS service profile, my certificate is not listed. If i create a self signed cert from the Palo itself, that cert appears as a choice. Is there some format restriction on what kind of certificate can be used for a SSL/TLS Service Profile?
... View more
03-17-2016
07:20 PM
It appears that, after a user has authenticated to a Globalprotect portal for the first time, they are prompted to download and install client software. Does Globalprotect (or Palo Alto in general) provide the option of simple client SSL VPN? ie; when a user logs in, an applet is invisibly downloaded and installed in the background to provide VPN. As far as the client is concerned, they only had to log in and click OK a couple of times, then their machine is connected.
... View more
12-08-2015
07:31 PM
When filtering for users in the traffic log, is there any syntax for using wildcards? For example user.src eq 'domain\blah*' ?
... View more
Friday
24Posts
3Likes
0Solutions
Apr 03, 2020Last Visited
User
Activity
User
Profile
Latest posts by JimMcGrady
| Subject | Views | Posted |
|---|---|---|
| 126 | a week ago | |
| 149 | 2 weeks ago | |
| 404 | 3 weeks ago | |
| 282 | 3 weeks ago | |
| 374 | 3 weeks ago |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 | 02-03-2020 11:20 PM | |
| 1 | 01-08-2020 09:17 PM | |
| 1 | 08-26-2019 10:41 PM |
User Badges
Public Statistics
| Date Registered | 12-08-2015 07:28 PM |
| Date Last Visited | Friday |
| Total Messages Posted | 35 |
| Total Likes Received | 3 |
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
Friday
|
Latest Blogs
Latest Posts
Copyright 2007 - 2020 - Palo Alto Networks
