LIVEcommunity - About bmorris1

bmorris1 · ‎11-30-2017

Hi @Shye80 You've got two options. Connect to the device using a console cable and remove the permitted IP configuration on the CLI. Connect up a client to the network and give it Panorama's IP address. Pretty risky this one though as you'd have to shut down Panorama or change it's IP which could impact your PAN deployment if you're logging and making changes etc on it. hope this helps, Ben

bmorris1 · ‎11-22-2017

Hi @OMatlock, I wonder if you have asynchronus routing caused by the switch 1. Can you try running a packet capture on the interface circled to see if the return traffic is coming back to the wrong interface? As I understand it you want the traffic to be coming back to ethernet1/3 on the PA-200 #2. If this is the issue then I would think you can resolve it with a NAT rule. hope this helps, Ben

bmorris1 · ‎11-22-2017

Hi @rjdahav163 My advice would be to take a look at the certificate hierarchy in Windows, are you seeing the full chain there that is expected when you open up the file? Example here, taken from the live community website: hope this helps, Ben

bmorris1 · ‎11-16-2017

@MickBall Yes it is in the GP app config, in the GP portal @NIRAVK9 I'm not sure on this one as I have never done it myself as I've never needed portal redundancy due the above cookie authentication. A solution may be to allow users to change the portal address and use different portals but the same gateways. GP should connect to the gateway that responds first.

bmorris1 · ‎11-15-2017

Hi @NIRAVK9, You would need a script to automatically modify the DNS record if the 1st site was to go down. You can poll the firewall to see if it is up/interface up using SNMP. Though you can set the portal cookie to stay for a week on clients so they only need to connect to the portal once every 5-7 days, this is usually enough time to get the portal up and running again if it goes down (RMA/case with ISP etc.). Alternatively you could look at GP in the cloud? https://www.paloaltonetworks.com/products/innovations/globalprotect-cloud-service hope this helps, Ben

bmorris1 · ‎11-08-2017

@MickBall you can override the default inter-zone deny rule (panos 6.1 and above) and set the log action to get the information from a 'deny all' rule. Currently your rule would deny intra-zone traffic as well.

bmorris1 · ‎10-30-2017

The session browser will show you the size of the session in bytes but it won't tell you how many bytes downloaded/uploaded, just in total. Once you kill the session and a log entry is generated in the traffic log, you can see bytes sent and bytes receieved in the 'details' section. Click the spyglass icon on the left hand side of the log to open up the detailed log view.

bmorris1 · ‎10-30-2017

Hi Radmin_85, Yes you can do this in the session browser located in the monitor tab and clicking the 'x' on the desired session. Or you can do it via the CLI by using the commmand: > clear session id xxxx x being the number of the session of course. You can use the command: > show session all to show a list of sessions on the device currently (up to 1024). hope this helps, Ben

bmorris1 · ‎10-30-2017

Hi junior_r, SSO will try to authenticate against both portal and gateway. So you'll either need to keep SSO on and live with the error message of the 1st auth against the gateway or disable it and enter the username and password on the login screen and GP after login. https://live.paloaltonetworks.com/t5/Featured-Articles/Tips-amp-Tricks-Single-Sign-on-SSO-for-GlobalProtect/ta-p/112186 Personally I think the first option is the best as it is more seamless to users, they will log in on the login window with their username and password and then be prompted for the OTP by GP, they won't see that it has failed the 1st gateway authentication.

bmorris1 · ‎10-29-2017

Hi Junior_r, Are you using the same auth profile for both portal and gateway? I suspect what is happening is that you are trying to do SSO/Authentication twice with the same OTP, so authenticating once against the portal and again against the gateway with the same OTP. Most OTP operators make it so that you can't use the same OTP twice, so your authentication is failing on the second go. The way to get around this is to use two different authentication profiles, one for the portal and one for the gateway. The portal authentication will be set as your standard login with username and password and your gateway config will have the auth profile set to use the OTP login. This way you will auth once to the portal with username/password, then you'll need to authenticate again against the gateway and thus be prompted for your OTP code. You can combine this with cookie authentication for the portal so after a first successful login to the portal this authentication gets cached and only a single authetncation using the OTP is required. Hope this helps, Ben

bmorris1 · ‎10-18-2017

Hi awawa100, NAT takes place separately to App-ID (app override). You can find full details in the packet flow document here: https://live.paloaltonetworks.com/t5/Learning-Articles/Packet-Flow-Sequence-in-PAN-OS/ta-p/56081 hope this helps, Ben

bmorris1 · ‎10-12-2017

Hi Larry, It might be easier to use User-ID for this purpose. Have a 'webinar' user group and have a single rule for them instead of constantly modifying a security rules, you just need to add the people that need access to webinars into the webinar user group on your AD for them to have access. If they're not in the user group then they can match the default-deny rule. You could combine this with a new feature in Windows Server 2016 which is 'timed group membership'. hope this helps, Ben

bmorris1 · ‎10-12-2017

Also make sure to restart the User-ID service once you've implemented the ignore user list so it picks up and reads the list.

bmorris1 · ‎10-10-2017

Hi Ronnie, I would suspect you need to speak to BT as it looks like their end causing the issue. If you leave the IP address as 'none' do the devices connect? If they do check then runtime info and see if you've been provisioned your 'static' IP. hope this helps, Ben

bmorris1 · ‎09-22-2017

Hi Miki, Do you mean configuration information? You can enter configure mode then take a look at the profiles > configure # show profiles virus 'av profile name' hope this helps, Ben

Member Since	‎07-28-2014 06:19 AM
Date Last Visited	‎04-11-2019 06:45 AM
Posts	227
Total Likes Received	60

Online Status	Offline
Date Last Visited	‎04-11-2019 06:45 AM

Re: Stuck out of management

Re: Re-creating a specific routing configuration.

Re: Enterprise PKI Cert Chain Error

Re: global protect multiple portal issue

Re: global protect multiple portal issue

Re: Two Subnets For Two Group Of People

Re: Delete all Address Objects

Re: Re-creating a specific routing configuration.

Re: Incorrect User-ID

Re: A Summer Question: Craziest Next-Generation Firewall deployment?

Re: QoS: why is it capped at 1 Gbps?

PPPoE Interface Settings For PA-220 Eircom

Re: WildFire Submission no logs

Re: Two Subnets For Two Group Of People

Global Protect Linux and Strongswan

Re: Stuck out of management

Re: Re-creating a specific routing configuration.

Re: Enterprise PKI Cert Chain Error

Re: global protect multiple portal issue

Re: global protect multiple portal issue

Re: The dreaded any

Re: do Palo Alto kill the connection in real time?

Re: do Palo Alto kill the connection in real time?

Re: Has anyone gotten GP user-logon (ALWAYS on) and OTP working together?

Re: Has anyone gotten GP user-logon (ALWAYS on) and OTP working together?

Re: How to settings NAT and Application Override?

Re: rules to allow webinars while blocking http-audio and http-video

Re: Incorrect User-ID

Re: PPPoE, static IP and Brittish Telecom

Re: How can I get Antivirus Profiles information from CLI?

Network Security

Cloud Security

Security Operations