About cengasser

Couple of questions on FIPS.   When you enable FIPS140 on a Palo it wipes the device. Can you just reload your last saved? Can a FIPS140 enabled device talk to a non-FIPS device over an ipsec tunnel provided the cyphers are compatible? FIPS disables PAP. System wide? or Just for authentication to the FW? Our Radius doesn't support CHAP. Anything else that will cause my resume to spontaneously print out? Thanks. ... View more

I've run into a couple of situations where I've had to update the firewall configuration manually because it was disconnected from pan (The ISP forced me to change IPs).  The config in Panorama remains unchanged. How do I update this without deleting and re-adding the device? Can I just do another import device config like I'm doing it for the first time? ... View more

trying to find out if there's a list of the various messages and what they mean, particulary with 'globalprotectgateway-logout-succ'. I'm specifically trying to identify what 'Reason: remove previous login' means.   I assume it means the previous session didn't close and a new session was created, like if the user's machine goes to sleep or reboots. Can't find any sort of rosetta stone for this in Palos' documentation.   Thanks. ... View more

I have a HA-pair of 3050s in my corp office with an single existing IPSEC tunnel to a remote office on a 200.   The remote office has very poor reliability on it's existing connection and the local ISP has provided them with a backup satcom link they can use when the prime connection goes down.   the HA-pair sits behind a Single IP that's managed via BGP on a HA-pair of routers with redundent internet links. The main IP will float between the routers using HSRP.   If it was only a matter of flipping a route on the remote 200, it wouldn't be an issue, but how do I get the tunnel to migrate from one local IP to another?   Thanks. ... View more

Hi.   I have two different HA-pairs with GP VPN configured on them. I'm trying to get HIP to work on the client, but I'm running into issues.   First issue is there are a number of applications we're checking for including Dell Kace and Comodo AV Suite and GP isn't seeing it on most of our clients. When it does see it, it only appears to recognize old versions (v6.4 for Kace & v8 for Comodo). How are these checks governed? Can they be edited?   Second is when I define custom checks it never seems to work, then one of the checks I created worked all of a sudden on one of the HA-Pairs, but not the other (The one that worked is running PanOS 8.2 and the other is running PanOS 7.1.10)   Has anyone else run into issues like this? What are my options? ... View more

I'm wondering if anyone can explain this to me.   I've recently started working with Panorama. When I import devices I follow this process:   Add device, and input the serial number of the device and commit. Wait for it to connect. Import device configuration into panorama. (I've tried both selecting import shared objects and not selecting it) If I just try to push to device next after the import, I get an error saying "invalid device name" and the commit immeadiately fails. If I commit to panorama prior to pushing to device, that error goes away. But..... Every device I import, all the existing policy rules fail because it says there is a duplicate and I have to rename the rule in Panorama, commit and repush, which duplicates the rule on the device and I have then delete the old rules. Someone please tell me how to make this stop. The next 4 devices I have already have 50+ policy rules, I can't be renaming all of them. All I really even want Panorama for is backups and updates.   Thanks. ... View more

The instructions for blocking clients are really vague on the whole 'Host ID' option. How do I find this without direct access to the client? All I have the hostname, userid and IPs. ... View more

When configuring a timeout on Globalprotect, the documentation reads:   On the GlobalProtect Gateway Configuration dialog, select Agent Timeout Settings and then configure the following settings: Modify the maximum Login Lifetime for a single gateway login session. The default login lifetime is 30 days—during the lifetime, the user stays logged in as long as the gateway receives a HIP check from the endpoint within the Inactivity Logout period. After this time, the login session automatically logs out. It doesn't seem to notify people when it timesout. It just drops them. Is this a setting somewhere? ... View more

I'm looking to configure a Palo as a router on a stick for a site to replace a decrepid Cisco 1811r router. The only printed information I can find is a 4.x document with pretty dissimilar UI images.   I've configured mutliple subinterfaces underneath my primary trusted interface, each one is tagged with the vlan tags being used on the L2 switches, and all are bound to the virtual router. The connected switch interface will be trunked.   Do I need to actually define unique Zones, or like Tunnels, can I just put them all in the "Trusted" Zone if I don't care about intervlan security?   Thanks. ... View more

My HA 3050 pair is currently running 7.1.5 and I am planning an upgrade spree.   The upgrade process that I read seems straight-forward. My main concerns are with IPSEC tunnels and GP clients.   My options right now are upgrading to 7.1.9 or just going to 8.1. Has anyone run into any issues with tunnels and/or clients no longer being able to connect after performing such an upgrade? Should the far end tunnels be upgraded first? or does it really matter?   Thanks. ... View more

Does anyone have any experience with configuring VPN to use the UPN instead of sAMAccountName? I'm trying to get a configuration working using a Radius Multifactor system that requires the UPN, and while I can get that part to work, I can't figure out how to control access to the VPN via AD group membership. If I put AD groups in the allow filter I can't login, it only works with the UPN if I do "Any".   When I look at the logs the firewall appears to be seeing my account name as domainname/username@domainname whereas in AD, the groupmembership enumerates from AD as domainname/username.   I need to be able to authenticate and map to AD groups with the userPrincipalName. This is easypeasy on an ASA. I'm able to see all users in my AD without issues from the PA.   Thanks.   ... View more