About ansharma

@MichelZ Not at the moment. Probably, in the future there would be a direct integration with MFA with GP. But for now, we'd have to use RADIUS as a proxy.   Regards, Anurag ... View more

Open the certificate presented by the portal. Go to the details tab and then check the Signature Algorithm. This is where RSA SSA-PSA would be, if the certificate is using it. I doubt it though, in your case, as 2 machines are able to connect. We'd need to check the GP agent logs to figure out what's going on. ... View more

Choose 'User-logon' as the connect method. Navigate to Portal->Agent->Config->App and change the connect method. If not saving credentials or using OTP in passwords, the user should reconnect without any prompt. You could also try using authentication cookies, to avoid entering credentials again and again. HTH.   Regards, Anurag ... View more

(T12744) 07/31/17 07:54:44:748 Info (2523): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_SECURE_FAILURE, this=000002D6B7CD91F0) (T12744) 07/31/17 07:54:44:748 Info (2536): winhttpObj, dwCertError is: (T12744) 07/31/17 07:54:44:748 Info (2542): WINHTTP_CALLBACK_STATUS_FLAG_SECURITY_CHANNEL_ERROR (T12744) 07/31/17 07:54:44:748 Debug(2549): do not force 1.2 now (T12744) 07/31/17 07:54:44:748 Info (2523): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, this=000002D6B7CD91F0) Something's not right with the certificates used. Make sure the certificate used in the portal's SSL-TLS profile is not using  RSASSA-PSS as the algorithm. That is not supported.   Regards, Anurag ... View more

Hi @Udineverisch   T11260) 07/30/17 12:26:00:522 Debug(4418): prelogin to portal result is (null) (T11260) 07/30/17 12:26:00:522 Debug(4574): Failed to pre-login to the portal XXXXXXXX. Error 0 This indicates that the GP client couldn't even connect to the portal. Not much detail is present here. As a test, can you browse to the https page of the portal and login there? Also, share PanGPA.log for attempt from the GP client.   Regards, Anurag ... View more

@vsys_remo Yes, using my method the user would have to login again but it's not because of the user-ip mapping. Authentication policy is a new feature (starting 8.0) and works slightly different from the former captive portal, although it uses captive portal as one of the pieces of configuration.    The user would be logging in again because there are 2 independent set of authentications happening. One at the portal login page and another using the Authentication policy.   In congruence with you and @BPry, receiving GP agent directly (without having to login) does not really post a security risk. The portal authentication's real job is not to deliver GP agent, instead it's focus is during the actual VPN connection.     Regards, Anurag   ... View more

I though the user wanted to know a way to force authentication for people going directly to the download link rather than the portal first. This is what the method above provides.   Honestly, you can't prevent people from knowing the portal link. I mean, most companies use something simple like gp.acme.com or vpn.acme.com. And, besides Geolocation blocking, you could just find many of them accessible. So, what if you did - it's requiring someone to do a portal login to connect and/or using the Authentication policy to download the GP client from their portal.   Additionally, even if someone downloads the GP from the portal link, the only thing being taxed is the firewall's resource providing the download, which again you can enforce authentication using the method described. One can go to cisco's website from any valid (entitled) account and download Anyconnect client. A blank VPN client is just that, blank.   Regards, Anurag ... View more

Hi FabienJ,   This is possible.   You'd need an external web-server to host the GP software. Now, if you can configure some sort of authentication there, that's all well and good. If not, you can make use of PAN OS 8.0 for the 'Authentication policy' feature (this is what I'll demonstrate). For authentication policy approach, you should be hosting the file on a http server. Using this method, you can even do MFA for just the download, so I guess that's a plus.   Well, here are the steps:   Login to the command line and issue the following commands: set global-protect redirect location <path of the external server repository of the file> set global-protect redirect on In my case, since I didn't have a http server, I just chose something random like: http://www.ipvoid.com Run the command - set global-protect redirect show You should see the output similar to mine:   cfg.global-protect.redirect.flag: True cfg.global-protect.redirect.location: http://www.ipvoid.com   At this point, you are pretty much done if you are doing authentication on that external server.   Proceed if you want to use the Authentication policy approach.   1. Create a captive portal Redirect host, in your case, will be the external facing address that can server the authentication page. Choose an appropriate SSL/TLS profile and authentication profile.   2. Create an authentication policy   Please keep in mind that you'd have to choose the source zone as Outside. I am using Inside because of the way my lab setup is configured. Also, the destination zone would be something depending on where the file hosting server lies and if NAT is required or not. Destination adddress would be whatever address you have entered as the file server. You can choose Authentication Enforcement to use two-factor, if you want. I am just using a simple Web-form (captive portal).   Here's the demo:   Whether I go to the GP-portal, login and then click on the download GP client links or directly enter https://<my-portal-address>/global-protect/getmsi.esp?version=64&platform=windows , I will get an MFA portal page (customizable btw, under Device->Response pages), which will look like this:     I would authenticate and then the firewall would redirect me to the file server (in this case it's just going to ipvoid.com).     Hope that helps.   Regards, Anurag     ... View more

@mike_yand @jintan Yes, it should. Give me some time to test in the lab. ... View more

Hello @Sbarlock and @DKanta ,   Honestly, this can be caused due to n number of reasons and conditions.   Best course of action - Open a TAC support case, if you can.   Regards, Anurag ... View more

  Hi @pablo77 ,   Couple of pointers:   The link urlfiltering.paloaltonetworks.com is for URLs and will not help in sorting out wrong Geolocations. The pre-defined regions database that Palo Alto Networks uses is the one defined by the Internet Assigned Numbers Authority (IANA) per globe zones that can be found at the following locations: AfriNIC Africa Region -->   ftp://ftp.afrinic.net/pub/stats/afrinic/ APNIC Asia/Pacific Region -->   http://ftp.apnic.net/stats/apnic/ ARIN North America Region -->   ftp://ftp.arin.net/pub/stats/arin/ LACNIC Latin America and some Caribbean Islands -->   http://bgp.potaroo.net/stats/lacnic/delegated   << direct link RIPE NCC (Europe, Russia, Middle East, Central Asia) -->   http://ftp.apnic.net/stats/ripe-ncc You could try updating the content version (Apps+Threats) because that's how they are updated in the PA. Verify it's correctly updated in IANA. If it's not showing correctly there, PA will not read any different. You can use this KB can help as a workaround.   HTH.   Regards, Anurag ... View more

Hey Robert,   Welcome to the community!   So, ftp-over-HTTP is accessing the server in the browser by ftp:// instead of http://. An example would be - ftp://speedtest.tele2.net/    This shows a page like the below:     Palo Alto is smart enough to recognize the underlying application which is 'ftp'. The logs from my attempt:     Now, most FTP servers do (and imo should) function as 'Passive' server. Meaning, the client would make the data connection after the control connection, which is what's shown in the screenshot above.    If the FTP server is in Active state, then you'd have to allow inbound connection from the server to the client. FYI - I am assuming that the client is behind the firewall and the FTP server is outside somewhere in the www.   Regards, Anurag ... View more

Hey!   1. Run this command on the CMD of that machine - echo %logonserver% 2. Check if you have that DC added in the Server monitoring section. 3. If it's not there, add it. Issue resolved. 4. If it's there, check if there is an event log generated for that user's login. 5. Check useridd.log - less mp-log useridd.log   HTH, Anurag ... View more

@jintan MFA can be used in conjunction with GP. GP client would present the user with a link which would be the MFA login page.  ... View more

Hi Andrew,   Please contact your SE to raise a feature request (or vote on an already existing one) to make this available on DP interfaces.   Regards, Anurag ... View more

If we (firewall) have sent the reply traffic correctly, and it doesn't make to the client, it's possible it's blocked by the ISP. Are all the clients (coming from different ISPs) having the same issue?  ... View more

Very well documented post!   1) If you are entering the domain yourself, under Authentication profile->User domain, then put the user modifier as %username% only.   2) If step (1) doesn't work, then run:   > tail follow yes mp-log authd.log   and then try to authenticate. Copy and paste those logs here.   Good Luck! ... View more

Hi Geoff,   Have you enabled syslog listener on the management profile?   Once you have that committed, you are sure to receive SYSLOG packets in tcpdump. Maybe check/remove any filter you got while taking a tcpdump.   Run the following commands and check logs. admin@anuragFW> debug user-id on debug admin@anuragFW> debug user-id set userid syslog admin@anuragFW> tail follow yes mp-log useridd.log   Then, to verify your regex/filter expression use the following commands:   admin@anuragFW>  test user-id user-id-syslog-parse regex-identifier event-regex <value> username-regex <value> address-regex <value> log-string <value> admin@anuragFW>  test user-id user-id-syslog-parse field-identifier event-string <value> username-prefix <value> username-delimiter <value> address-prefix <value> address-delimiter <value> log-string <value   If you are having trouble figuring out which regex is not being read correctly, feed the log-string values different sections of syslog messages. That's just something you gotta play around and figure out. Some special characters need to be escaped while some will not be allowed.   You can post a sample of syslog messages and we could possibly look into it.   Hope this helps.   Regards, Anurag ... View more

Hi Dannon,   We are currently looking into this. It may very well be with the cloud servers and not your firewall. Ignore it for now, I guess.   Regards, Anurag     ... View more