About mprintz

Yeah, we've been using GP for years and haven't changed the DNS name since we started.  The IP hasn't been changed for at least 2 years.  We have over 100 users connected right now.   The users are remote; we don't have any other VPNs we use and I doubt the users would know how to make their own 😂 .   I just added the internal host detection today (as a potential fix to an unrelated cursor-changing-focus issue), but that's not going to do anything for remote users. ... View more

I looked at that too, but it's just 2 generic errors that aren't helpful.  One says "No Network Connectivity" but that's definitely not correct because the users can do everything else on their computers, 90% of which is online. ... View more

For affected users, the only event we're seeing in the GP log on the firewall is portal-prelogin.  I've looked at the pangps.log from an affected client and it wasn't really helpful.  We've tried a few different GP versions, including the latest 6.1.0, and full uninstall/reboot/install.   Based on this thread, I'm thinking it might actually be a Windows update issue, but we haven't gotten to testing either uninstalling the October CU or installing the out-of-band patch noted there.  Thanks.   Matt ... View more

Hi @palomed ,   We're having a similar issue, just using standard authentication, not certificates.  Were you able to get a resolution for the issue?  Thanks.   Matt ... View more

I'm having the same issue after upgrading to 10.1.5 (from 10.1.4-h4).  I tried the steps that @reaper posted, but I get an error in the CLI when trying to delete.  Guess I'll revert back to 10.1.4-h4 until this is resolved. user@FW_1(active)# delete rulebase security rules "Allow XYZ" hip-profiles any Invalid syntax. ***Quick update - the downgrade to 10.1.4-h4 fixed the issue and I was able to commit again without removing the hip-profiles from security rules in the CLI.   Matt ... View more

I had the same question and just found this tidbit from the GP 5.2 release notes: "(GlobalProtect app 5.2.9 and later releases) To enable an improved authentication experience, you can now configure the GlobalProtect app to continue to display the status panel while the end user is entering their credentials when logging in or cancels the request. By default, the Allow GlobalProtect UI to Persist for User Input setting is disabled. The end user must click outside the status panel to minimize it manually when entering their credentials. Available with Content Release Version 8450-6909 or later."   Matt ... View more

Now that 9.1.10 has been released, I checked out the release notes and I don't see that bug mentioned anywhere (either by number or description).  Where did you get the info that the fix was in that release?  Thanks. ... View more

Thanks for the update.  Unfortunately for me, it doesn't look like the fix made it into 9.1 yet (or I'm missing it in the addressed issues list). ... View more

Did you guys ever resolve this?  I'm now experiencing the same issue.  No local WF box, but I did just upgrade our PA-3020s to 9.1.3 yesterday (never saw the error before that).  Thanks. ... View more

@BPry Yes, I am for that URL category and a handful of other URLs (none of the ones in the logs I've posted), as well as some non-HTTP services.  However, that's a recent change I made to see if it would fix the problem, but it didn't.   Matt ... View more

I changed the Custom URL Category so that it only contains the URLs below, but I'm still seeing all sorts of other URLs in the logs (http://www.harmelin.com/Palo/log2.png).  Any other ideas?  Thanks.   @BPry We are using Zscaler, so it would make sense that some of the traffic would have been hitting that rule before, if it was destined for akamai and Zscaler uses their service.   Matt   *.update.microsoft.com *.windowsupdate.com *.windowsupdate.microsoft.com download.microsoft.com ntservicepack.microsoft.com windowsupdate.microsoft.com ... View more

Wow, I don't know what's going on here with the pictures.  I see them after posting, but then a few minutes later they don't show up.  Let's try it via links instead of embedded photos.   Matt   Security Rule: http://www.harmelin.com/Palo/secrule.png URL Category: http://www.harmelin.com/Palo/urlcat.png Log: http://www.harmelin.com/Palo/log.png   ... View more

Sorry about that, not sure what happened.  I could even see them when I did the preview.  Let's try again.   Matt   Security rule:   Custom URL category:   Log - in this case, lines 3, 6, & 11 showing the mismatched URLs: ... View more