About mgarg

It seems when you have the decryption rule enabled, firewall is failing to decrypt the session and ending with cert validation error. Open up a case with TAC to check why the decryption is failing. There was a bug reported on 7.1.4 code for 3k devices where the decryption failed to proxy memory pool exhaustion and was fixed on 7.1.11 or 8.0.3   But getting a validation from TAC engineer would be the first step here. ... View more

In the logs i see this error "failed authentication for user 'angusg'. Reason: User is not in allowlist"   In your authentication profile change the user domain to none ( you will have to type it) and keep the user name modifier as %USERINPUT%     ... View more

I see an authentication success message in the logs 'Authentication succeeded for user "test"2.'     Can you try connecting from Global protect client with the same user and share the output from the authd.log.  You can run a "tail follow yes mp-log authd.log" in the command line when attempting to connect from client.   ... View more

For BYOD, you can use captive portal to learn the mapping.   https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Captive-Portal/tac-p/60461#M926 ... View more

Should not be an issue if everything is setup fine else open up a ticket with TAC for faster resolution. ... View more

in the global counters i see a warning "tcp_drop_out_of_wnd - out-of-window packets dropped". As per the packet captures the client seems to be resetting the connection because the 3-way handshake is not completing and the weird part is that it sends retransmission packets after sending rst packets.    Anyway, here is an explanation as to why the firewall is dropping the packet and you can test if the command that is given below to check if it works ( Just a way to confirm the problem and not a solution).   tcp_drop_out_of_wnd - out-of-window packets dropped The Palo Alto Networks Firewall creates a sliding sequence window starting with the original ACK (the window size is based on the type of traffic within the session). It is expected that the packet sequence numbers within the current session reside within this sliding window. This window adjusts with the type of traffic and whenever new ACK messages are received. The default behavior on the device is to drop packets when sequence numbers are outside this window.   This feature can be added to the config file and applied with a commit, which is required to override the default behavior after rebooting:   > configure # set deviceconfig setting tcp asymmetric-path < bypass|drop > # commit   I think the packets that you have captured are client side. It would be more helpful if you can capture the packet on the firewall as well for receive, transmit and drop stage. That way you can check what response is received from the server before the firewall drops the packet.     ... View more

This does not seem to be an SSL issue because we do not see even the 3-way handshake completing.   For the first packet from source port 57901, there is not corresponding syn ack. What is see is an 'Ack' packet from the server, which is something the client would not be expecting and thus resets the connection in the following packet.    Take simultaneously pcap on firewall and client and compare packets for one particular stream. Also, you can check global counters. On the firewall set the filter as source 10.160.74.142 and destination as 193.41.234.29. Turn on the filter, access the website and in the cli type "show counter global filter packet-filter yes delta yes" 3 -4 times.   If the firewall is sending rst due to some reason, then counters should show some reason.  Post your results.   ... View more

You will have to setup xauth configuration in the global protect to use the Linux based VPN client to connect to the gateway.   Starting with PAN OS 5.0, xAuth is supported with VPNC on a couple of distros. The following VPN clients are now supported for GlobalProtect VPN access: o Ubuntu Linux 10.04 LTS VPNC o CentOS 6 VPNC ... View more

natively global protect agent is not supported for linux systems. You can use the native VPN application.  However, you can try running the global protect application with WINE and it would be interesting if this works   https://www.pcworld.com/article/2900497/how-to-run-windows-software-in-linux-everything-you-need-to-know.html   Post any results that you come across. ... View more

There is a possibility that the application might be pulling info from a different URL that could be blocked due to URL filtering profile.   To find that URL, create an URL filtering profile and keep all categories as "Alert". Create a test rule for one test machine and apply this URL filtering profile. Access the application from this test machine. Now when you head over to the URL filtering logs, you can see what all URL links were accessed. Identify the ones that could be related to the application and whitelist them in your original rule. Then disable the test rule and check if the application works.   ... View more