This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
- Panorama
- AIOps for NGFW
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- Cloud NGFW for AWS
- CN-Series
- VM-Series:
- Private Cloud
- OCI
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
- Cortex Xpanse
Security Operations
- Resources
About bmorris1
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About bmorris1
04-11-2019
227Posts
60Likes
27Solutions
Apr 11, 2019Last Visited
User
Activity
User
Profile
Latest posts by bmorris1
| Subject | Views | Posted |
|---|---|---|
| 1252 | 11-30-2017 04:59 AM | |
| 1615 | 11-22-2017 02:02 AM | |
| 1339 | 11-22-2017 01:52 AM | |
| 2333 | 11-16-2017 01:49 AM | |
| 2346 | 11-15-2017 09:05 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 10-11-2016 01:33 AM | |
| 1 Like | 09-01-2015 09:23 AM | |
| 1 Like | 11-22-2017 02:02 AM | |
| 1 Like | 10-12-2017 04:32 AM | |
| 1 Like | 07-24-2017 02:35 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 2 Likes | |||
| 1 Like | |||
| 2 Likes | |||
| 1 Like | |||
| 3 Likes |
User Badges
Community Statistics
| Member Since | 07-28-2014 06:19 AM |
| Date Last Visited | 04-11-2019 06:45 AM |
| Posts | 227 |
| Total Likes Received | 60 |
11-30-2017
04:59 AM
Hi @Shye80 You've got two options. Connect to the device using a console cable and remove the permitted IP configuration on the CLI. Connect up a client to the network and give it Panorama's IP address. Pretty risky this one though as you'd have to shut down Panorama or change it's IP which could impact your PAN deployment if you're logging and making changes etc on it. hope this helps, Ben
... View more
11-22-2017
02:02 AM
1 Kudo
Hi @OMatlock, I wonder if you have asynchronus routing caused by the switch 1. Can you try running a packet capture on the interface circled to see if the return traffic is coming back to the wrong interface? As I understand it you want the traffic to be coming back to ethernet1/3 on the PA-200 #2. If this is the issue then I would think you can resolve it with a NAT rule. hope this helps, Ben
... View more
11-22-2017
01:52 AM
Hi @rjdahav163 My advice would be to take a look at the certificate hierarchy in Windows, are you seeing the full chain there that is expected when you open up the file? Example here, taken from the live community website: hope this helps, Ben
... View more
11-16-2017
01:49 AM
@MickBall Yes it is in the GP app config, in the GP portal @NIRAVK9 I'm not sure on this one as I have never done it myself as I've never needed portal redundancy due the above cookie authentication. A solution may be to allow users to change the portal address and use different portals but the same gateways. GP should connect to the gateway that responds first.
... View more
11-15-2017
09:05 AM
Hi @NIRAVK9, You would need a script to automatically modify the DNS record if the 1st site was to go down. You can poll the firewall to see if it is up/interface up using SNMP. Though you can set the portal cookie to stay for a week on clients so they only need to connect to the portal once every 5-7 days, this is usually enough time to get the portal up and running again if it goes down (RMA/case with ISP etc.). Alternatively you could look at GP in the cloud? https://www.paloaltonetworks.com/products/innovations/globalprotect-cloud-service hope this helps, Ben
... View more
11-08-2017
03:50 AM
@MickBall you can override the default inter-zone deny rule (panos 6.1 and above) and set the log action to get the information from a 'deny all' rule. Currently your rule would deny intra-zone traffic as well.
... View more
10-30-2017
05:31 AM
The session browser will show you the size of the session in bytes but it won't tell you how many bytes downloaded/uploaded, just in total. Once you kill the session and a log entry is generated in the traffic log, you can see bytes sent and bytes receieved in the 'details' section. Click the spyglass icon on the left hand side of the log to open up the detailed log view.
... View more
10-30-2017
05:20 AM
Hi Radmin_85, Yes you can do this in the session browser located in the monitor tab and clicking the 'x' on the desired session. Or you can do it via the CLI by using the commmand: > clear session id xxxx x being the number of the session of course. You can use the command: > show session all to show a list of sessions on the device currently (up to 1024). hope this helps, Ben
... View more
10-30-2017
02:51 AM
Hi junior_r, SSO will try to authenticate against both portal and gateway. So you'll either need to keep SSO on and live with the error message of the 1st auth against the gateway or disable it and enter the username and password on the login screen and GP after login. https://live.paloaltonetworks.com/t5/Featured-Articles/Tips-amp-Tricks-Single-Sign-on-SSO-for-GlobalProtect/ta-p/112186 Personally I think the first option is the best as it is more seamless to users, they will log in on the login window with their username and password and then be prompted for the OTP by GP, they won't see that it has failed the 1st gateway authentication.
... View more
10-29-2017
01:57 PM
Hi Junior_r, Are you using the same auth profile for both portal and gateway? I suspect what is happening is that you are trying to do SSO/Authentication twice with the same OTP, so authenticating once against the portal and again against the gateway with the same OTP. Most OTP operators make it so that you can't use the same OTP twice, so your authentication is failing on the second go. The way to get around this is to use two different authentication profiles, one for the portal and one for the gateway. The portal authentication will be set as your standard login with username and password and your gateway config will have the auth profile set to use the OTP login. This way you will auth once to the portal with username/password, then you'll need to authenticate again against the gateway and thus be prompted for your OTP code. You can combine this with cookie authentication for the portal so after a first successful login to the portal this authentication gets cached and only a single authetncation using the OTP is required. Hope this helps, Ben
... View more
10-18-2017
02:59 AM
Hi awawa100, NAT takes place separately to App-ID (app override). You can find full details in the packet flow document here: https://live.paloaltonetworks.com/t5/Learning-Articles/Packet-Flow-Sequence-in-PAN-OS/ta-p/56081 hope this helps, Ben
... View more
10-12-2017
04:53 AM
Hi Larry, It might be easier to use User-ID for this purpose. Have a 'webinar' user group and have a single rule for them instead of constantly modifying a security rules, you just need to add the people that need access to webinars into the webinar user group on your AD for them to have access. If they're not in the user group then they can match the default-deny rule. You could combine this with a new feature in Windows Server 2016 which is 'timed group membership'. hope this helps, Ben
... View more
10-12-2017
04:32 AM
1 Kudo
Also make sure to restart the User-ID service once you've implemented the ignore user list so it picks up and reads the list.
... View more
10-10-2017
06:38 AM
Hi Ronnie, I would suspect you need to speak to BT as it looks like their end causing the issue. If you leave the IP address as 'none' do the devices connect? If they do check then runtime info and see if you've been provisioned your 'static' IP. hope this helps, Ben
... View more
09-22-2017
06:32 AM
Hi Miki, Do you mean configuration information? You can enter configure mode then take a look at the profiles > configure # show profiles virus 'av profile name' hope this helps, Ben
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-11-2019
06:45 AM
|
Likes Given To
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks