About ansharma

@MichelZ Not at the moment. Probably, in the future there would be a direct integration with MFA with GP. But for now, we'd have to use RADIUS as a proxy.   Regards, Anurag ... View more

Open the certificate presented by the portal. Go to the details tab and then check the Signature Algorithm. This is where RSA SSA-PSA would be, if the certificate is using it. I doubt it though, in your case, as 2 machines are able to connect. We'd need to check the GP agent logs to figure out what's going on. ... View more

Choose 'User-logon' as the connect method. Navigate to Portal->Agent->Config->App and change the connect method. If not saving credentials or using OTP in passwords, the user should reconnect without any prompt. You could also try using authentication cookies, to avoid entering credentials again and again. HTH.   Regards, Anurag ... View more

(T12744) 07/31/17 07:54:44:748 Info (2523): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_SECURE_FAILURE, this=000002D6B7CD91F0) (T12744) 07/31/17 07:54:44:748 Info (2536): winhttpObj, dwCertError is: (T12744) 07/31/17 07:54:44:748 Info (2542): WINHTTP_CALLBACK_STATUS_FLAG_SECURITY_CHANNEL_ERROR (T12744) 07/31/17 07:54:44:748 Debug(2549): do not force 1.2 now (T12744) 07/31/17 07:54:44:748 Info (2523): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, this=000002D6B7CD91F0) Something's not right with the certificates used. Make sure the certificate used in the portal's SSL-TLS profile is not using  RSASSA-PSS as the algorithm. That is not supported.   Regards, Anurag ... View more

Hi @Udineverisch   T11260) 07/30/17 12:26:00:522 Debug(4418): prelogin to portal result is (null) (T11260) 07/30/17 12:26:00:522 Debug(4574): Failed to pre-login to the portal XXXXXXXX. Error 0 This indicates that the GP client couldn't even connect to the portal. Not much detail is present here. As a test, can you browse to the https page of the portal and login there? Also, share PanGPA.log for attempt from the GP client.   Regards, Anurag ... View more

@vsys_remo Yes, using my method the user would have to login again but it's not because of the user-ip mapping. Authentication policy is a new feature (starting 8.0) and works slightly different from the former captive portal, although it uses captive portal as one of the pieces of configuration.    The user would be logging in again because there are 2 independent set of authentications happening. One at the portal login page and another using the Authentication policy.   In congruence with you and @BPry, receiving GP agent directly (without having to login) does not really post a security risk. The portal authentication's real job is not to deliver GP agent, instead it's focus is during the actual VPN connection.     Regards, Anurag   ... View more

I though the user wanted to know a way to force authentication for people going directly to the download link rather than the portal first. This is what the method above provides.   Honestly, you can't prevent people from knowing the portal link. I mean, most companies use something simple like gp.acme.com or vpn.acme.com. And, besides Geolocation blocking, you could just find many of them accessible. So, what if you did - it's requiring someone to do a portal login to connect and/or using the Authentication policy to download the GP client from their portal.   Additionally, even if someone downloads the GP from the portal link, the only thing being taxed is the firewall's resource providing the download, which again you can enforce authentication using the method described. One can go to cisco's website from any valid (entitled) account and download Anyconnect client. A blank VPN client is just that, blank.   Regards, Anurag ... View more

Hi FabienJ,   This is possible.   You'd need an external web-server to host the GP software. Now, if you can configure some sort of authentication there, that's all well and good. If not, you can make use of PAN OS 8.0 for the 'Authentication policy' feature (this is what I'll demonstrate). For authentication policy approach, you should be hosting the file on a http server. Using this method, you can even do MFA for just the download, so I guess that's a plus.   Well, here are the steps:   Login to the command line and issue the following commands: set global-protect redirect location <path of the external server repository of the file> set global-protect redirect on In my case, since I didn't have a http server, I just chose something random like: http://www.ipvoid.com Run the command - set global-protect redirect show You should see the output similar to mine:   cfg.global-protect.redirect.flag: True cfg.global-protect.redirect.location: http://www.ipvoid.com   At this point, you are pretty much done if you are doing authentication on that external server.   Proceed if you want to use the Authentication policy approach.   1. Create a captive portal Redirect host, in your case, will be the external facing address that can server the authentication page. Choose an appropriate SSL/TLS profile and authentication profile.   2. Create an authentication policy   Please keep in mind that you'd have to choose the source zone as Outside. I am using Inside because of the way my lab setup is configured. Also, the destination zone would be something depending on where the file hosting server lies and if NAT is required or not. Destination adddress would be whatever address you have entered as the file server. You can choose Authentication Enforcement to use two-factor, if you want. I am just using a simple Web-form (captive portal).   Here's the demo:   Whether I go to the GP-portal, login and then click on the download GP client links or directly enter https://<my-portal-address>/global-protect/getmsi.esp?version=64&platform=windows , I will get an MFA portal page (customizable btw, under Device->Response pages), which will look like this:     I would authenticate and then the firewall would redirect me to the file server (in this case it's just going to ipvoid.com).     Hope that helps.   Regards, Anurag     ... View more

@mike_yand @jintan Yes, it should. Give me some time to test in the lab. ... View more

Hello @Sbarlock and @DKanta ,   Honestly, this can be caused due to n number of reasons and conditions.   Best course of action - Open a TAC support case, if you can.   Regards, Anurag ... View more

  Hi @pablo77 ,   Couple of pointers:   The link urlfiltering.paloaltonetworks.com is for URLs and will not help in sorting out wrong Geolocations. The pre-defined regions database that Palo Alto Networks uses is the one defined by the Internet Assigned Numbers Authority (IANA) per globe zones that can be found at the following locations: AfriNIC Africa Region -->   ftp://ftp.afrinic.net/pub/stats/afrinic/ APNIC Asia/Pacific Region -->   http://ftp.apnic.net/stats/apnic/ ARIN North America Region -->   ftp://ftp.arin.net/pub/stats/arin/ LACNIC Latin America and some Caribbean Islands -->   http://bgp.potaroo.net/stats/lacnic/delegated   << direct link RIPE NCC (Europe, Russia, Middle East, Central Asia) -->   http://ftp.apnic.net/stats/ripe-ncc You could try updating the content version (Apps+Threats) because that's how they are updated in the PA. Verify it's correctly updated in IANA. If it's not showing correctly there, PA will not read any different. You can use this KB can help as a workaround.   HTH.   Regards, Anurag ... View more