About mmelone

I'm having an issue where GP HIPS appear to expire, rendering all my rules useless and the client gets blocked eveywhere I have the HIP profile enabled. It happens after an hour of connectivity and its not always consistent. It kills long term ssh/rdp sessions and it does not seem to be related to idle timeout (3hr) or max time out (12hr).   Will decreasing the check time help?  ... View more

Did you open udp port 4501 on the host firewall of the host running the GP client? Only with that port open on the host will you see the authentication prompt pop up from the GP client. I had to do this for SSH auth policy. The service in the auth policy will be the TCP RDP port.  ... View more

Are you talking about address resolutions in the logs in the monitor tab or FQDN objects in a security policy?  If you set the DNS server for the firewall, it will resolve addresses in the monitor tab logs against the DNS server set in the Device Setup config area.  ... View more

I was informed by some project managers that this is a limiatation of the current implementation of panorama and objects vs template settings.  ... View more

 @Mike.ship and @nbilal   Thanks for the good information sharing and sorry for my pervious long-winded response.  ... View more

@Mike.ship I also have the problem with being able to have an overall shared Cert Profile object tied to EDL objects.  When the shared box is checkec on a shared EDL object, I cannot reference the Cert Profile, even with the cert profile pushed to the device template. This is using panorama.  The shared cert profiles can only be used within a template. For example, a Cert Profile created as shared in Tempalte "ABC" cannot be referenced by a shared EDL object. In order for the EDL object to reference the Cert Profile, the EDL must be in ABC location.  A "shared" EDL in a device group related to the template where the the shared Cert profile lives cannot see the cert profile even though the Cert Profile is shared. Only a non shared EDL can see the Cert Profile.   This makes me believe shared template objects dont necessarily mean they are able to be seen by shared Device Group Objects.  It makes me believe that EDL objects can only reference a cert profile that already lives on the device via it's template.  It's been slightly confusing when configuring EDLs on panos8 using panorama and getting those lists/cert profiles to work accross all devices. I'm ending up having to make 3 seperate EDLs of the same list for my 3 differeny vSYSs of one device. Those vSYSs device groups cannot see my Shared cert profile in the template of the devices where the 3 vSYSs are.  Maybe I'm configuring things wrong or that is just how it's designed.  ... View more

FYI: If you run apple enterprise connect or other AD password syncing tools on mac:   Mac systems running macOS High Sierra in your organization may be impacted by an issue that prevents Active Directory password changes from working properly. You may be impacted if Mac systems in your organization meet both of the following criteria: Mac systems are bound to Active Directory Users log into their Mac systems with Active Directory accounts (mobile accounts) If you are impacted by this issue, changing your Active Directory password will appear to succeed, but the password will not be changed. If your users log into their Mac systems with local accounts (not mobile accounts) they will be unaffected. Any tools that can change the password for an Active Directory based mobile account will be affected. This includes Enterprise Connect and the Users & Groups System Preferences pane. This issue will be fixed in an upcoming macOS High Sierra update. ... View more

Traps 4.1.1 for MAC has 10.13 support.  ... View more

In my experience, I have found that shortening the agent heartbeat time from 60 min to 10 or 15 gives you better metrics on who is connected. It also provides quicker policy pushes and agent upgrade actions (if you use ESM to upgrade instead of SCCM).  ... View more