About nikoo

There is a security rule with two FQDN objects used as destination. Along with that user group is configured and source/destination zones - nothing special. There have been a couple of cases where traffic suddenly stops hitting the rule although everything seems to be in the place. It turns out on of the two FQDN address objects is not resolving anymore (which is fine as it was removed from the DNS) and as soon as removing that unresolvable object, traffic to other FQDN (which resolved just fine) destination started working and traffic hit the rule correctly. Not sure if that was solved by really removing the unresolvable object or just committing something would do the trick as well (as in both cases commit included removing the object). Haven't been able to reproduce the issue yet. Have someone seen something like this? Ideas? ... View more

After upgrading from 9.1.13-h to 9.1.14 issue was noticed  (not sure if it was present earlier) - in about a week/two GlobalProtect stops responding - even portal page is not opening from the browser, so also GP client connection fails. It is not getting to authentication or anything further. Portal IP is responding in general - pings are fine and even initial TCP 3-way handshake is seen in the captures. HA failover to secondary helps. Rebooting failed device helps. Rebooting only dataplane also helps. Took some information and will research that, not going too deep here, but, by any chance, has anyone seen something like this? ... View more