LIVEcommunity - About hshawn

hshawn · ‎05-06-2020

While I do agree with you, my guess is they rely on their customers using something else for this (PRTG, LibreNMS, Obersvium, other). You can also use the Pan(w)achrome extension in your browser which will use the API to generate the data/charts/graphs.

hshawn · ‎05-05-2020

For me the issue is that if you are running a GP portal on port 80/443 then these methods for getting an LE cert won't work. Even NATing port 80 into another server that will only work when accessed by IP (hostname will try to use https) Changing the ports that GP runs on is not a very elegant solution. I think having functionality built into PANOS that will take the GP portal into consideration might be helpful. For example in my case it would be nice to have a cert on my lab portal.

hshawn · ‎04-01-2020

When we see this it is 100% of the time due to the user(s) not being in the AD group that is allowed to use the VPN. Once they are added to the proper group then they get a valid IP. I did see this one other time after a PANOS upgrade everyone had 0.0.0.0 and that was a visual "glitch/bug" the user still had an IP address when checked on the CLI.

hshawn · ‎03-16-2020

Disable HA, boom you have two firewalls. If they are already licensed then that should do it. You will need to then do what you need for your network so that each is running the config they need. Make sure to cross your fingers and hope that you do not need the benefits of HA anymore.

hshawn · ‎03-14-2020

Nah, you can do this without impacting any currently connected users. Yesterday we added more IPs to the pools * Make sure the range you are using is not already in use * Add the new range to appropriate pool(s) * Edit/update any routes and objects you may have all existing connections will be untouched

hshawn · ‎03-13-2020

@jdelio Thank you! I don't ever think of that anymore but thanks to your post I was able to do some testing and link this to a bad stick of RAM. The device had to 2Gb DDR3 sticks in there for a 4Gb total, booting with the one 2Gb good stick resulted in it actually booting up but it would then shutdown and reboot over and over again. I popped an 8Gb stick in there and it boots up and is functional now. Not sure what the previous owner did but may have zapped the RAM sticks. I was able to upgrade it from 7.1.4 to 7.1.24 but that's about all I can do without licenses. Unable to go past 8.x since I can't get app package to manually install Pretty sure there is still something else going on because it is fighting me on some things and likes to complain about not getting a config lock. I will keep poking at it for a bit and then just give it back to my friend and let him deal with it 🙂

hshawn · ‎03-11-2020

adding to what @atluri4b8 already said you can also use a bang !(addr.dst in 8.8.8.8) will exclude 8.8.8.8

hshawn · ‎03-11-2020

A friend of mine found a PA200 at a thrift store for $5.00 (without a power supply) I plugged it in today to see what state it was in and it looks like it had a rough life... All the guts are still inside and everything is clean and connected however it won't even get to the initial bootup MAINT prompt, anyone seen this before? Sometimes I get this bootup, most of the time I get hex output to the screen and the "board will reset" message in an endless loop, and sometimes all interface lights light up. The MGT port lights up and gets traffic blinks but I seriously doubt it is usable at this stage (I do not see it getting or having an IP this early). I am going to hand it back to him and tell him he has a nice paper weight at this point but curious if anyone has seen these errors before.

hshawn · ‎03-10-2020

I don't think they have it setup to: * Use the gnome task bar * Adapt to "dark" themes But it does work, here is what I did: * Create a "shortcut" on your desktop or in the dash-to-dock or wherever you like * Download a nice GP icon from the internet and pop that onto your shortcut properties It should get better over time, it didn't used to show the GUI version at all and now with 5.1.1 it does. It also did not work with all flavors of Linux without some hacks and it should now work with any Linux.

hshawn · ‎02-26-2020

@reaper Hmm, What about clientless VPN?

hshawn · ‎01-03-2020

Thanks for the info! I have been researching and I believe I am out of luck since I use Google Domains (not gcloud) and they do not have an API. I may have to move to another service to take advantage of the script.

hshawn · ‎01-02-2020

This is interesting, I am glad I found this thread because it appears this acme.sh script may be what works for my lab setup however reading through the docs I do not see an option that would work for a PAN firewall that is hosting a GP VPN (ports 80 and 443 are in use). There is mention in this thread about this working without needing inbound connections but I am not seeing that outlined here: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert I will comb through the docs more when I get off home tonight but am I missing something? Is this still in the works or should this give me a Let's Encrypt cert with auto renewal for the firewall (without needing a server behind the firewall exposed to the internet) as it is today? Use case: Generate a valid cert for the GP VPN portal domain.

hshawn · ‎01-02-2020

I have been playing with new features in 9.1 in the lab and have noticed a couple things that others may want to be aware of: * The Global Protect ACC tab is nice, however it does not include Global Protect client-less activity * With the addition of new GP logging there is now a GP log setting under the device/log settings tab. This allows for setting up forwarding rules but sadly will not allow you to setup built-in actions (i.e. when a user fails a login auto tag the source IP for use in a policy)

hshawn · ‎12-19-2019

I was not on the beta. My main issue with this UI version is there seems to be no way of actually running it (no icon, no menu entry, the binary just complains about CLI mode). Maybe its just a fresh bug.

hshawn · ‎12-19-2019

I have the GP Linux CLI client working without any issues, however I wanted to test the UI client that just came out (5.1.0) Does anyone know how to actually use this? The PAN documentation has not been updated to mention this new version or the Linux UI yet. Installing it goes fine but I do not see anything installed to my desktop and when attempting to launch it from a command shell all I see is: "Unable to run GlobalProtect CLI while GlobalProtect UI is running. Please consider installing the CLI only install package." Which is great... but how do I find and launch the UI from my desktop? *confused*

Member Since	‎05-05-2016 08:35 AM
Date Last Visited
Posts	169
Total Likes Received	48

Re: Dear Palo Alto Networks:

Re: LetsEncrypt integration

Re: Global Protect user private IP shows 0.0.0.0

Re: HA Pair licence

Re: Changes to GP Gateway IP Pool

Re: PA220 so slow rebooting

FQDN cache limitations

Re: Dear Palo Alto Networks:

Re: No logs in the monitor > traffic tab?

Re: Global Protect user private IP shows 0.0.0.0

Re: i2c bootup errors (PA200)

Re: Crazy Q... Minemeld on raspberry pi?

LetsEncrypt integration

Re: Global Protect new Linux UI

Re: Multicast with Chromecasts confusion

Re: Dear Palo Alto Networks:

Re: LetsEncrypt integration

Re: Global Protect user private IP shows 0.0.0.0

Re: HA Pair licence

Re: Changes to GP Gateway IP Pool

Re: i2c bootup errors (PA200)

Re: Can you Exclude an address from your traffic search?

i2c bootup errors (PA200)

Re: Global Protect new Linux UI

Re: CSRF Protection

Re: LetsEncrypt integration

Re: LetsEncrypt integration

9.1 testing - a couple things...

Re: Global Protect new Linux UI

Global Protect new Linux UI

Network Security

Cloud Security

Security Operations