About nikoo

Hello,   There are Smart Cards being used for the GP authentication. One of the options for Windows endpoints is to disconnect the GP as soon as Smart Card is removed and that was tested, option in the app settings: "Retain Connection on Smart Card Removal" set to No. But the result after removing the Smart Card is that prompt is shown to the user with two options: OK or Cancel. If clicking OK - GP is disconnected and no new connection can be established as there is no Smart Card connected. If clicking Cancel - connection is retained, all the previous resources work as expected and there's nothing preventing user to continue. Is this really expected behavior? Is anyone using this feature and may have any input? ... View more

Hello,   Configuring host firewall via XDR and I cannot seem to get the Windows environment variables running. Basically, there's an implicit deny for inbound/outbound connections, so there are applications that require some internal/localhost connections that are blocked. Due to this specific allow rule for such an application has to be made - based on the application path.  Specific application I'm talking about - Zoom. I've created rule that allows %USERPROFILE%\AppData\Roaming\Zoom\bin\Zoom.exe and %USERPROFILE%\AppData\Roaming\Zoom\bin\Zoom_launcher.exe, but this is not working and it can be seen in the Event Viewer that this app is being blocked by WFP by the implicit deny rule. If adding specific host firewall rule with full path (C:\Users\<username>\AppData\Roaming\Zoom\bin\Zoom.exe - app is working as expected, but that does not cover all the user cases, as this path depends on the user logged into the computer. Documentation says that it should be possible to user these environment variables: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/hardened-endpoint-security/host-firewall.html " Enter the full path and name of a program you want the rule to apply to. If you use system variables in the path definition, you must re-enforce the policy on the endpoint every time the directories and/or system variables on the endpoint change. "   Has anyone tried adding such a rules and did it succeed, is there any trick behind this? ... View more

There is a Smart Card solution that uses pkcs#11 and middlware that provides OS communication to the card. Is there a way to use this certificate from the card for GlobalProtect authentication? GP is looking for a cert in a specific location, but it is not possible to extract it from the Smart Card and import for GP (https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLMaCAO).   Is this supported at all? If so, is there any information available? ... View more

There's deployment with Panorama and currently one HA PA pair managed by it. Panorama sitting at 9.1.5, firewalls at 9.1.4. Cortex Data Lake license is assigned to Panorama and seen in the Panorama -> Licenses section. In order for the firewalls to send the logs to Data Lake, I followed this guide: https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-cortex-data-lake/panorama-and-cortex-data-lake/license-the-panorama-and-install-the-plugin and then https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-cortex-data-lake/panorama-and-cortex-data-lake/forward-logs-from-panorama-managed-firewalls.html#id35a50f81-3b75-4919-b60d-1db38d6ee7b8  Issue: Cannot assign Logging Service license from the Panorama to managed devices - it is simply not present and refresh does not help, meaning I fail at step 2 from the 2nd link. Cloud service from Panorama perspective is validated and seems to be communicating just fine. So far I've tried: Upgrading Panorama from 9.1.4 to 9.1.5. Removing/re-adding Cloud Plugin to Panorama. Deleting all licenses from the PA and fetching once more via Panorama. There could be something obvious, but any ideas? ... View more

IKEv2 on PA has built in keepalive mechanism, but it can only act if the communication is lost for more than 5 minutes: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClgcCAC After testing it out, about 7-8 minutes passed until Palo Alto detected lost peer and did reset of the tunnel. That's happening due to built in algorithm: The default interval of liveness checking is every 5 seconds when SA is idle. Upon losing connection, the firewall will do 10 liveness retries with increasing timeout (seconds) for each retry as follows:   1 + 2 + 4 + 8 + 16 + 32 + 64 + 64 + 64 + 64 = 319 seconds (about 5 minutes)   .. meaning it is not configurable in any way? Is there a way to speed it up? Tunnel monitoring didn't seem to be an option, because tunnel is proxyID based and there are 4 proxyIDs configured - tunnel monitoring was working properly for one of them (source/destination pair), but at the same time concluded that other 3 of them are down and did the reset every 10 seconds or so which is not acceptable.   Basically, what are your options to detect the IPSec tunnel peer down condition and act as soon as possible, meaning, tear down the tunnel and start re-negotiation. ... View more

Hi,   I'm doing decryption for Exchange 2013 OWA web part and it was doing good - was seeing mostly applications like ms-exchange, activesync, outlook-web which makes sense. Customer upgraded their infrastructure to Exchange 2016 and after trying to decryot that I'm getting a bunch of unknown-tcp traffic after decryption instead of ms-exchange and/or outlook-web. Even for full length sessions with bunch of traffic. Activesync still seems to be recognized normally. Due to that had to allow unknown-tcp traffic in security policy as well, which is not great, but still better then not decrypting at all.   Decryption itself seems to be working fine, as there are no errors, same key was used on the new servers when migration was done.   Have anyone seen similar results? ... View more

Hi,   Although looking through this in internal sources as well, but maybe you guys have seen this and have an idea.   Initially there was PA VM-100 trial registered in Support Account 1 - partner account. Everything's good. Trial expired, full license was purchased - auth code was registered in Support Account 2 - customer specific account. VM-100 was deactivated and re-registered in the Support Account 2 with a new auth code, licenses were uploaded manually to the device and they look valid, but at the same time it is not possible to get Software updates, GP packages, retrieve licese keys for license server, etc. due to Error: "Failed to install licenses. Serial Number doesn't belong to this support account."   As soon as I transferred the VM back to original Support Account 1 - it started working. Transferred back to Support Account 2 - same error message. As mentioned - licenses show up fine, S/N is registered on Support Account 2 and can be seen as active.    From my side it looks like VM is still hanging to the original account where the Trial was started, even though it was re-registered.   Any ideas? ... View more