This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
- Panorama
- AIOps for NGFW
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- Cloud NGFW for AWS
- CN-Series
- VM-Series:
- Private Cloud
- OCI
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
- Cortex Xpanse
Security Operations
- Resources
About hshawn
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About hshawn
172Posts
51Likes
10Solutions
Last Visited
User
Activity
User
Profile
Latest posts by hshawn
| Subject | Views | Posted |
|---|---|---|
| 418 | 03-28-2022 08:57 AM | |
| 442 | 03-28-2022 08:04 AM | |
| 583 | 03-25-2022 04:35 PM | |
| 2554 | 05-06-2020 11:19 AM | |
| 5915 | 05-05-2020 10:05 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 03-11-2020 11:01 AM | |
| 1 Like | 03-25-2022 04:35 PM | |
| 1 Like | 06-12-2019 09:25 AM | |
| 1 Like | 01-10-2019 10:57 AM | |
| 1 Like | 05-06-2020 11:19 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like | |||
| 2 Likes | |||
| 1 Like | |||
| 11 Likes | |||
| 1 Like |
User Badges
Community Statistics
| Member Since | 05-05-2016 08:35 AM |
| Date Last Visited | |
| Posts | 172 |
| Total Likes Received | 51 |
03-28-2022
08:57 AM
Thanks for the info. reported
... View more
03-28-2022
08:04 AM
@honardsin I am not sure I understand this response, I was already using clientless VPN and it was working great until later releases of PANOS. Clientless VPN is so broken right now that even the release notes for the latest version of the clientless VPN dynamic update errors out An error occurred while processing your request. Reference #199.bb92d817.1648479788.8547a35
... View more
03-25-2022
04:35 PM
1 Kudo
Timeline of my struggles: Somewhere between 10.1.0 and 10.1.4 the clientless VPN stopped showing icons for each app not super big deal because the apps still worked but after trying a couple upgrades... 10.1.5: brings the icons back! but now the apps themselves do not work at all trying by IP to rule out DNS issues trying with https in case its something to do with http/80 ok ok let's try 10.2: clientless VPN portal page apps are all gone! page is blank! No apps, no icons, nothing here downgraded back to 10.1.4 again: apps work but no icons I guess we are stuck on 10.1.4 forever? What is going on? Is there some magic toggle added that was not required prior to 10.1.x or is this just a hot mess of clientless bugs? 🙂 UPDATE: Traffic logs show no attempts and no traffic from the VPN zone so I cannot even do a pcap. The 404 errors are coming from the firewall/portal itself before it even gets to reverse proxy to the app on the inside.
... View more
05-06-2020
11:19 AM
1 Kudo
While I do agree with you, my guess is they rely on their customers using something else for this (PRTG, LibreNMS, Obersvium, other). You can also use the Pan(w)achrome extension in your browser which will use the API to generate the data/charts/graphs.
... View more
05-05-2020
10:05 AM
For me the issue is that if you are running a GP portal on port 80/443 then these methods for getting an LE cert won't work. Even NATing port 80 into another server that will only work when accessed by IP (hostname will try to use https) Changing the ports that GP runs on is not a very elegant solution. I think having functionality built into PANOS that will take the GP portal into consideration might be helpful. For example in my case it would be nice to have a cert on my lab portal.
... View more
04-01-2020
01:51 PM
1 Kudo
When we see this it is 100% of the time due to the user(s) not being in the AD group that is allowed to use the VPN. Once they are added to the proper group then they get a valid IP. I did see this one other time after a PANOS upgrade everyone had 0.0.0.0 and that was a visual "glitch/bug" the user still had an IP address when checked on the CLI.
... View more
03-16-2020
02:21 PM
Disable HA, boom you have two firewalls. If they are already licensed then that should do it. You will need to then do what you need for your network so that each is running the config they need. Make sure to cross your fingers and hope that you do not need the benefits of HA anymore.
... View more
03-14-2020
07:37 AM
Nah, you can do this without impacting any currently connected users. Yesterday we added more IPs to the pools * Make sure the range you are using is not already in use * Add the new range to appropriate pool(s) * Edit/update any routes and objects you may have all existing connections will be untouched
... View more
03-13-2020
08:02 AM
@jdelio Thank you! I don't ever think of that anymore but thanks to your post I was able to do some testing and link this to a bad stick of RAM. The device had to 2Gb DDR3 sticks in there for a 4Gb total, booting with the one 2Gb good stick resulted in it actually booting up but it would then shutdown and reboot over and over again. I popped an 8Gb stick in there and it boots up and is functional now. Not sure what the previous owner did but may have zapped the RAM sticks. I was able to upgrade it from 7.1.4 to 7.1.24 but that's about all I can do without licenses. Unable to go past 8.x since I can't get app package to manually install Pretty sure there is still something else going on because it is fighting me on some things and likes to complain about not getting a config lock. I will keep poking at it for a bit and then just give it back to my friend and let him deal with it 🙂
... View more
03-11-2020
11:01 AM
1 Kudo
adding to what @atluri4b8 already said you can also use a bang !(addr.dst in 8.8.8.8) will exclude 8.8.8.8
... View more
03-11-2020
10:23 AM
A friend of mine found a PA200 at a thrift store for $5.00 (without a power supply) I plugged it in today to see what state it was in and it looks like it had a rough life... All the guts are still inside and everything is clean and connected however it won't even get to the initial bootup MAINT prompt, anyone seen this before? Sometimes I get this bootup, most of the time I get hex output to the screen and the "board will reset" message in an endless loop, and sometimes all interface lights light up. The MGT port lights up and gets traffic blinks but I seriously doubt it is usable at this stage (I do not see it getting or having an IP this early). I am going to hand it back to him and tell him he has a nice paper weight at this point but curious if anyone has seen these errors before.
... View more
03-10-2020
08:21 AM
I don't think they have it setup to: * Use the gnome task bar * Adapt to "dark" themes But it does work, here is what I did: * Create a "shortcut" on your desktop or in the dash-to-dock or wherever you like * Download a nice GP icon from the internet and pop that onto your shortcut properties It should get better over time, it didn't used to show the GUI version at all and now with 5.1.1 it does. It also did not work with all flavors of Linux without some hacks and it should now work with any Linux.
... View more
01-03-2020
10:25 AM
Thanks for the info! I have been researching and I believe I am out of luck since I use Google Domains (not gcloud) and they do not have an API. I may have to move to another service to take advantage of the script.
... View more
01-02-2020
03:56 PM
This is interesting, I am glad I found this thread because it appears this acme.sh script may be what works for my lab setup however reading through the docs I do not see an option that would work for a PAN firewall that is hosting a GP VPN (ports 80 and 443 are in use). There is mention in this thread about this working without needing inbound connections but I am not seeing that outlined here: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert I will comb through the docs more when I get off home tonight but am I missing something? Is this still in the works or should this give me a Let's Encrypt cert with auto renewal for the firewall (without needing a server behind the firewall exposed to the internet) as it is today? Use case: Generate a valid cert for the GP VPN portal domain.
... View more
Contact Me
Latest Tags
No tags yet
Likes From
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks