This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About cafowler
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About cafowler
05-31-2023
18Posts
1Like
1Solution
May 31, 2023Last Visited
User
Activity
User
Profile
Latest posts by cafowler
| Subject | Views | Posted |
|---|---|---|
| 564 | 09-07-2022 05:38 AM | |
| 7748 | 05-13-2020 06:58 AM | |
| 4039 | 08-12-2019 01:27 PM | |
| 7912 | 05-03-2019 05:31 AM | |
| 7918 | 04-25-2019 12:01 PM | |
| 7930 | 04-25-2019 10:49 AM | |
| 4896 | 02-09-2017 05:58 AM | |
| 4928 | 02-01-2017 08:48 AM | |
| 1847 | 09-11-2015 01:03 PM | |
| 2444 | 02-12-2015 08:55 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 05-13-2020 06:58 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 8 Likes | |||
| 1 Like | |||
| 2 Likes | |||
| 2 Likes |
User Badges
Community Statistics
| Member Since | 07-07-2014 01:05 PM |
| Date Last Visited | 05-31-2023 03:31 PM |
| Posts | 18 |
| Total Likes Received | 1 |
09-07-2022
05:38 AM
Hey all,
Recently we noticed that users connecting via GlobalProtect who are restricted to a device when logging on, are failing with a message in the logs "invalid username or password". In AD the user has the LogonWorkstations property populated restricting their logon to that device. If the property is cleared, GlobalProtect successfully connects.
GlobalProtect v 5.2.8
PAN-OS v10.1.5-h2
Wondering if anyone's witnessed similar behavior.
Thanks,
CF
... View more
05-13-2020
06:58 AM
1 Kudo
@RLGFRY - same sort of issue with our config / support ticket. The tech presented some suggestions that didn't make logical sense. We are on PAN-OS 9.x and our exclusions are configured by subnet only, and individually, even though we can use address groups in 9.x. We are also only interested in Teams traffic at the moment. We have verified that some Teams traffic is leaving via the local gateway but also that some Teams traffic is coming back through the VPN. The solution we ended up using was to create a deny policy to the same 3 subnets we used via Split Tunnel as exclusions. Through testing we have been able to verify that we can see this traffic being denied by the new policy and also that Teams is not broken (at least not yet). Here is the MS article, which you've probably already read, it was under the Configuring and Securing Teams Media Traffic section. https://docs.microsoft.com/en-us/office365/enterprise/office-365-vpn-implement-split-tunnel#configuring-and-securing-teams-media-traffic I wanted to share with the community, since, simply using the subnets may not be the answer. Cheers, CF
... View more
08-12-2019
01:27 PM
Hey all, Recently upgraded to PAN-OS v9.0.3 and GlobalProtect is no longer working for some. Error messages in the system logs are showing GlobalProtect portal client configuration failed... Machine Certificate CN: (null) for those that fail but also Machine Certificate CN: (just a blank here) for those that are successful. This is intermittent and is affecting roughly 25% of our corporate users. I'm guessing "Machine Certificate" is a general term PA uses since there is no mention in the system logs of a "Client or User Certificate". We employ user certificates, not machine certificates. We have our portal configured to use User Certificates. We also have our Gateway and Portal configured to "Allow Authentication with user credentials OR Client Certificate". This only works IF we delete the client certificate on the endpoint, then they are able to login using only credentials. If we leave it in the OR position it seems to ignore the or and automatically fail with user credentials alone. Our certificate profile is setup to use the Subject Alt. Name / Principal Name for the username, which matches what's contained within the certificate which matches LDAP / AD. We do have a case open with Palo Alto. 1st response was that the CN can no longer be null - our logs say different, and the 2nd response was to try an older GP Agent, which we're in the process of. We've tried deleting the certificate on the failing client machines and re-issuing them - this doesn't work. A couple of our clients that were originally experiencing issues magically started working. Just wondering if anyone else has encountered something similar and / or has any suggestions. Thanks, cfowler
... View more
05-03-2019
05:31 AM
Thanks to all who replied. As suspected, once we connected a proper secondary power supply, the LED cleared on it's own. Appreciate the help from everyone. Cheers CF
... View more
04-25-2019
12:01 PM
Thank you for the response. There was no alarm via the GUI. However, from a CLI, I see the following: chassis.leds: { 'alarm': Red, 'fans': Off, 'ha': Off, 'log': Off, 'status': Green, 'temp': Green, } and S1 0.85V Power Rail False 0.85 0.76 0.94 S1 0.9V Power Rail False 0.90 0.81 0.99 S1 1.2V Power Rail False 1.19 1.08 1.32 S1 1.8V Power Rail False 1.78 1.62 1.98 S1 2.5V Power Rail False 2.35 2.25 2.75 S1 3.3V Power Rail False 3.30 2.97 3.63 S1 3.3V SD Power Rail False 3.32 2.97 3.63 S1 5.0V Power Rail False 4.96 4.50 5.50 S1 12.0V IN A Power Rail False 12.10 11.40 12.60 S1 12.0V IN B Power Rail True 1.69 11.40 12.60 Which shows the short in B Power Rail, which is no longer connected. The alarm hasn't reset so I'm guessing the device will need to be power cycled to resolve.
... View more
04-25-2019
10:49 AM
Hey all, I have a PA-220 that has the Alarm LED lit. The cause was that someone tried to insert a power supply from a PA-200 into the PA-220. Thinking that what happened is that a brief short was created which triggered the alarm. All other LEDs are good. Anyone know a way to turn off the Alarm LED or clear it from the CLI or GUI? Thought maybe there was a debug or clear command but can't find one. Thanks, CF
... View more
- Tags:
- alarm led
- clear alarm
02-09-2017
05:58 AM
Thank you for the repsonse Peter, greatly appreciated. What we ended up doing is what you suggested in your first paragraph, we asked for a certificate to be issued which is a Subordinate CA. Problem solved. When I suggested the article " How to Implement Certificates Issued from Microsoft Certificate Services " it was met with hesitation, so haivng a certificate created which is a Subordinate worked out nicely. Cheers, Carter
... View more
02-01-2017
08:48 AM
Hi Everyone, Recently a decision was made to implement SSL Decryption for outbound inspection. We work within a Microsoft PKI environment and are experiencing issues in signing the CSR generated by the firewall. I create the CSR based on the "how to implement and test ssl decryption" document I found via the Live Community (https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Implement-and-Test-SSL-Decryption/ta-p/59719). So, the CSR is designated as a CA and set to Signed by External Authority (CSR). Unfortunately, each time I receive the certificate, the Forward Trust Certificate is greyed out. We've tried both - CA box checked and CA box unchecked, the result is the same. We did find that our SubCA's were under constraints and cannot sign, so we used the Root to perform the signing but the result is the same. Just wondering if anyone has a suggestion or if we need to review and follow the workaround I found here: https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Implement-Certificates-Issued-from-Microsoft-Certificate/ta-p/56757. thank you, Carter
... View more
- Tags:
- ssl-decryption
09-11-2015
01:03 PM
Hey all; This is probably a question that's been asked before but I'm wondering if there is a way to export a list of all security policies currently disabled. I'd like to have a short list for review. I've only been able to find the CLI to show unused security policies, and from the Policies section I can list all "disabled eq yes" but no way to create a file or quicklist of disabled policies. I found this article, but it's a tad time consuming, I was hoping there was an easier method that someone could share? Export a List of Address Objects or Security Policies and Import into a Spreadsheet Appreciate the help! Carter
... View more
02-12-2015
08:55 AM
Thank you everyone for your feedback. We took the opportunity to upgrade from 5.0.11 to 6.0.8 based on feedback both from support and the community. So far, so good.
... View more
02-04-2015
12:52 PM
So, I know this is a little dated but I've got the same question. Based on previous responses I'm going with 6.0.4... However, I also contacted support to get their input since most users I've spoken with via conferences, etc... suggest staying a couple versions back, but haven't heard back yet. I see the latest release as of today, Feb. 4th, 2015, is 6.0.8. Just wondering if anyone's got any experience with anything past 6.0.4. Cheers, Carter
... View more
09-05-2014
06:54 AM
Any chance you could explain what you mean by "override"? I'm experiencing a similar issue and nothing's changed so far as I can see but when I check the certificates under Device > Certificate Management > Certificates there is no "override" option as a setting on any of them? I should also mention the hardware is a 2050 with PANOS 5.0.11 - maybe the version & hardware make a difference? Clients receive the Client Certificate Error but the VPN still gets created and resources are still accessible, not sure if this is relevant?
... View more
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks