About MarcelST

Hi there, we are facing a weird situation with GlobalProtect pre-logon connections.   We have some laptops with machine certificate only (they do not have user certificates deployed). We want them to connect using this machine certificate, as "pre-logon", so they got limited/specific access to some company resources They are able to establish GP VPN connection but their session is a normal user connection instead of a pre-logon connection because, somehow, the Machine Certificate value is used as if it were a user. So, in short, this is what I'm saying:   These are some useful logs I found in the Tech Support files:   2021/01/14 13:23:05 info globalp GP-Por globalp 0 GlobalProtect portal client configuration generated. Login from: xxx.xxx.xxx.xxx, Source region: ES, User name: 7836523f-2a31-4e61-8583-252ad100fc62, Client OS version: Microsoft Windows 10 Pro , 64-bit, Config name: GP-Agent-HUB01-On-Demand.   2021/01/14 13:23:11 info globalp GP-Gat globalp 0 GlobalProtect gateway user login succeeded. Login from: xxx.xxx.xxx.xxx, Source region: ES, User name: 7836523f-2a31-4e61-8583-252ad100fc62, Client OS version: Microsoft Windows 10 Pro , 64-bit.   2021/01/14 13:23:11 info auth auth-su 0 Certificate validated for user '7836523f-2a31-4e61-8583-252ad100fc62'. From: xxx.xxx.xxx.xxx.   2021/01/14 13:23:12 info globalp GP-Gat globalp 0 GlobalProtect gateway client configuration generated. User name: 7836523f-2a31-4e61-8583-252ad100fc62, Private IP: 10.x.x.39, Client version: 5.1.3-12, Device name: COMMXTF47SVPGIT, Client OS version: Microsoft Windows 10 Pro , 64-bit, VPN type: Device Level VPN.     And this is the GlobalProtect Portal profile they are matching as per the logs (GP-Agent-HUB01-On-Demand):   ... View more

It seems recently there has been change on the "gpcloudservice.com" API recently.   Before the change this service was using a publicly-trusted certificate (not sure if Google, Digicert,...) but I just found out right now the site is using a Palo Alto not publicly-trusted certificate, which makes things break if you enforce the "verify=True" on requests, for example. Check it out here: https://api.gpcloudservice.com/getPrismaAccessIP/v2   Not cool for sure. This change would only do that many people sets the verify=False, which brings down security.   Can this be fixed please?     ... View more

The following guide provides the parsing for CEF-style Log Formats for PAN-OS 9.1: https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/cef/pan-os-91-cef-configuration-guide.pdf   We have been using this for a while, but because now we have a 2nd source of logs (PRISMA) aside from Panorama, we just found out the parsing suggested for "Threat" log is not correct in our opinion, and that was causing some issues on our SIEM use-cases.   In short, this field is wrong and should be replaced by $subtype:   Threat CEF:0|Palo Alto Networks|PAN-OS|$sender_sw_version|$threatid|$type|$number-of-severity|rt=$cef-formatted-receive_time deviceExternalId=$serial src=$src dst=$dst sourceTranslatedAddress=$natsrc destinationTranslatedAddress=$natdst cs1Label=Rule cs1=$rule suser=$srcuser duser=$dstuser app=$app cs3Label=Virtual System cs3=$vsys cs4Label=Source Zone cs4=$from cs5Label=Destination Zone cs5=$to deviceInboundInterface=$inbound_if deviceOutboundInterface=$outbound_if cs6Label=LogProfile cs6=$logset cn1Label=SessionID cn1=$sessionid cnt=$repeatcnt spt=$sport dpt=$dport sourceTranslatedPort=$natsport destinationTranslatedPort=$natdport flexString1Label=Flags flexString1=$flags proto=$proto act=$action request=$misc cs2Label=URL Category cs2=$category flexString2Label=Direction flexString2=$direction PanOSActionFlags=$actionflags externalId=$seqno cat=$threatid fileId=$pcap_id PanOSDGl1=$dg_hier_level_1 PanOSDGl2=$dg_hier_level_2 PanOSDGl3=$dg_hier_level_3 PanOSDGl4=$dg_hier_level_4 PanOSVsysName=$vsys_name dvchost=$device_name PanOSSrcUUID=$src_uuid PanOSDstUUID=$dst_uuid PanOSTunnelID=$tunnelid PanOSMonitorTag=$monitortag PanOSParentSessionID=$parent_session_id PanOSParentStartTime=$parent_start_time PanOSTunnelType=$tunnel PanOSThreatCategory=$thr_category PanOSContentVer=$contentver PanOSAssocID=$assoc_id PanOSPPID=$ppid PanOSHTTPHeader=$http_headers PanOSURLCatList=$url_category_list PanOSRuleUUID=$rule_uuid PanOSHTTP2Con=$http2_connection PanDynamicUsrgrp=$dynusergroup_name     How can we get this fixed in the document? Additionally, is it possible to get the document updated with PAN-OS 10 in here? ... View more