About palomed

We have several hundred Global Protect users using Auto VPN. It would be nice to  see their global protect logs, ipconfig /all, netstat -rn information before calling them back on a filed ticket. Can Cortex collect these logs on a regular basis without  user involvement? What has to be enabled at the GP client and/or PAN to  allow this log collection to occur? ... View more

I have two separate portal/gateways on two separate PANs. Call them gp1.acme.com and gp2.acme.com. If I wanted to make the gateway on gp2 be primary for laptops hitting gp1.acme.com portal - what happens at the network level? I presume I add a second gateway to portal gp1.acme.com. When the GP client reaches gp1.acme.com does it inform that client to go directly to gp2.acme.com. Does the client bypass the portal auth on gp2.acme.com when directed from gp1 portal to go to gp2 gateway?  ... View more

In watching the video below about global protect troubleshooting, them mentioned a feature "Run Diagnostics Tests for These Web Destinations". Is this test available whether or not you are using Prisma access and Data Lake? We're not using Prisma nor Data lake. But it would be nice to have diagnostics appear in log bundles referencing specific internal sites.   https://www.youtube.com/watch?v=Ik1rXsVdxl4 ... View more

We've been having difficulty with a particular use trying to connect with cert based authentication.  What's this telling me "failed to get portal config", "restrore last portal config from file" etc? Is there a good resource on these debug message generally?   (P4512-T6564)Debug(7054): 04/22/22 12:53:29:449 prelogin to portal result is (null) (P4512-T6564)Debug(7356): 04/22/22 12:53:29:449 Failed to pre-login to the portal gp.acmefireworks.com with return value 0(0). (P4512-T6564)Debug(8201): 04/22/22 12:53:29:449 Failed to get portal config from portal gp.acmefireworks.com. (P4512-T6564)Debug(8243): 04/22/22 12:53:29:449 Try to restore last portal config from file. (P4512-T6564)Debug(8290): 04/22/22 12:53:29:449 Skip retrieve cached portal configuration for empty user (P4512-T6564)Debug(8221): 04/22/22 12:53:29:449 portal status is Invalid portal. (P4512-T6564)Info (7461): 04/22/22 12:53:29:449 GetConfigFromPortal failed, restore previous prelogon username. m_preUsername pre-logon (P4512-T6564)Debug(6849): 04/22/22 12:53:29:449 --Set state to Disconnected ... View more

User running Global Protect 5.2.5-66 on Win 10 on Surface Pro was getting message "Portal Invalid". But when our tech remoted into her machine, he was able to see she could reach all internal resources. Any thought as to why GP would show Portal Invalid when actually connected and passing traffic? ... View more

On my Cisco ASA I have SAML configured and when I logon I get prompted with a browser dialog box for user name and password which then triggers an MFA token to my smart phone. But for Global Protect the client is going straight to Authentication Failed without prompting me for user name and password - neither within the Global Protect client nor in a separate browser windows. I follow the instructions below.    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g0000008U48CAE   In System Logs I am seeing the following errors:   Some debug from PANGPA.LOG: (P1920-T3992)Debug( 612): 04/13/22 17:21:10:457 CPanBaseConfigMgr::AddPortal - portal gpvpn.abcfi.com is already in list. (P1920-T3992)Debug( 612): 04/13/22 17:21:10:457 CPanBaseConfigMgr::AddPortal - portal gpvpn.abcfi.com is already in list. (P1920-T3992)Debug(2199): 04/13/22 17:21:10:457 Dialog Status is going to change from Connecting to Connecting. (P1920-T3992)Debug( 612): 04/13/22 17:21:10:464 CPanBaseConfigMgr::AddPortal - portal gpvpn.abcfi.com is already in list. (P1920-T3992)Debug( 612): 04/13/22 17:21:10:464 CPanBaseConfigMgr::AddPortal - portal gpvpn.abcfi.com is already in list. (P1920-T3992)Debug(2306): 04/13/22 17:21:10:465 receive resize message from 1, and new height is 206. (P1920-T3992)Debug( 240): 04/13/22 17:21:10:781 CPanSAMLView::OnDocumentComplete - page url navigated to = https://gpvpn.abcfi.com/SAML20/SP/ACS (P1920-T3992)Debug( 397): 04/13/22 17:21:10:785 CPanClientAuth::GetSavedCredential (P1920-T3992)Error( 790): 04/13/22 17:21:10:785 RetrieveGPCred failed. hr = 1168 (P1920-T3992)Debug( 612): 04/13/22 17:21:10:785 CPanBaseConfigMgr::AddPortal - portal gpvpn.abcfi.com is already in list. (P1920-T3992)Debug( 612): 04/13/22 17:21:10:785 CPanBaseConfigMgr::AddPortal - portal gpvpn.abcfi.com is already in list. (P1920-T3992)Info ( 854): 04/13/22 17:21:10:785 UI send saml username to update. (P1920-T3992)Debug( 153): 04/13/22 17:21:10:785 CPanClientAuth::HandleNewCredential. (P1920-T3992)Debug( 297): 04/13/22 17:21:10:785 CPanClientAuth::encryptPwd length 0. (P1920-T3992)Debug( 309): 04/13/22 17:21:10:785 CPanClientAuth::encryptPwd dwl 32. (P1920-T3992)Debug( 312): 04/13/22 17:21:10:785 CPanClientAuth::encryptPwd - len 32 . (P1920-T3992)Debug( 335): 04/13/22 17:21:10:785 CPanClientAuth::encryptBackup user is empty(P1920-T3992)Debug( 353): 04/13/22 17:21:10:785 CPanSAMLView::OnDocumentComplete - saml auth failed eventually. -1 times retries. (P1920-T12120)Debug( 611): 04/13/22 17:21:10:850 Send command to Pan Service (P1920-T12120)Debug( 626): 04/13/22 17:21:10:850 Command = <request><type>portal</type><portal>gpvpn.abcfi.com</portal><pid>1920</pid><path>C:\Users\muser\AppData\Local\Palo Alto Networks\GlobalProtect\</path><cert-name>pan-none-cert-selected</cert-name><reconnect-gateway-only>no</reconnect-gateway-only><checkupdate>no</checkupdate><allow-cached-portal>yes</allow-cached-portal><remember-me>yes</remember-me><retrieve-cache-only>no</retrieve-cache-only><manual-select-gateway-ip></manual-select-gateway-ip><portal-certificate-verification>yes</portal-certificate-verification><win-user>mmedw</win-user><user-profile-type>0</user-profile-type><preferred-gateway></preferred-gateway><preferred-gateway-address></preferred-gateway-address><proxy-auto-detect>1</proxy-auto-detect><proxy-config-url></proxy-config-url><proxy></proxy><proxy-bypass></proxy-bypass><saved-user></saved-user><saved-passwd></saved-passwd><portal-2fa>no</portal-2fa><prelogin-cookie>0</prelogin-cookie><saml-username>SAMLUser</saml-username><saml-auth-status>-1</saml-auth-status><saml-auth-error>Authentication Failed.</saml-auth-error><pre-logon-then-on-demand>no</pre-logon-then-on-demand><domain>DESKTOP-5ABC8MQ</domain><default-browser>0</default-browser></request> (P1920-T12120)Debug( 691): 04/13/22 17:21:10:850 PanClient sent successful with 1216 bytes (P1920-T3992)Debug( 121): 04/13/22 17:21:10:883 Received data from Pan Service (P1920-T12120)Debug( 611): 04/13/22 17:21:10:883 Send command to Pan Service (P1920-T12120)Debug( 639): 04/13/22 17:21:10:883 Command = <request><type>troubleshooting-log</type><error>Authentication Failed.</error><error-details>Authentication Failed.</error-details></request> (P1920-T3992)Debug( 608): 04/13/22 17:21:10:883 Current status is changed to -1. (P1920-T3992)Debug( 174): 04/13/22 17:21:10:883 username field is not empty. not override the username. (P1920-T3992)Debug( 203): 04/13/22 17:21:10:883 CPanBaseReceiver::HandleStatus - found discover-ready tag. value = n. (P1920-T3992)Debug( 210): 04/13/22 17:21:10:883 CPanBaseReceiver::HandleStatus - found cdl-log tag. value = n. (P1920-T3992)Debug( 270): 04/13/22 17:21:10:883 message type from the service = s <?xml version="1.0" encoding="UTF-8"?> <response> <type>status</type> <status>Disconnected</status> <protocol/> <portal-config-version>0</portal-config-version> <error-must-show/> <error-must-show-level>error</error-must-show-level> <error>Authentication Failed.</error> <product-version>5.2.5-66</product-version> <product-code>&quot;{C531B514-763E-4495-A3C4-1B28C749A343}&quot;</product-code> <portal-status>Invalid portal</portal-status> <user-name/> <username-type>regular</username-type> <state>Disconnected</state> <check-version>no</check-version> <portal>gpvpn.abcfi.com</portal> <discover-ready>no</discover-ready> <mdm-is-enabled>no</mdm-is-enabled> <cdl-log>no</cdl-log> ... View more

I am trying to understand how I could have two Global Protect cookie expiries within a half hour of successful certificate authentication.    7:04 Certificate Auth Successful and IP assigned 4/12/2022 7:04 portal-auth login Certificate LAPTOP-ADHDS8HOL US ACME-99918411157 55.55.58.239 0.0.0.0 0.0.0.0 4/12/2022 7:04 gateway-getconfig configuration SSLVPN LAPTOP-ADHDS8HOL US ACME-99918411157 55.55.58.239 0.0.0.0 10.1.249.8 Config name: Client-Config, Client region: US. success 7:32 Cookie Expired 4/12/2022 7:32 gateway-auth login Cookie pre-logon US ACME-99918411157 55.55.58.193 0.0.0.0 0.0.0.0 Cookie expired failure 4/12/2022 7:30 gateway-setup-ssl tunnel SSLVPN LAPTOP-ADHDS8HOL US ACME-99918411157 55.55.58.193 0.0.0.0 10.1.249.8 success 7:38 Cookie Expire (again) 4/12/2022 7:38 gateway-auth login Cookie pre-logon US ACME-99918411157 55.55.58.193 0.0.0.0 0.0.0.0 Cookie expired failure 4/12/2022 7:38 gateway-register login pre-logon US ACME-99918411157 55.55.58.193 0.0.0.0 0.0.0.0 Existing user session found failure   ... View more

I've added a VM PAN to allow more Global Protect connections. It's working well for my cert based GP users.  In the example below GP connects to 5.5.5.5, the 3220 PAN NATs that to an address on its DMZ 10.100.100.10 and the tunnels for like a champ. The Portal and Gateway are configured with the IP of the external IP of  the VM PAN 10.100.100.10.    Internet----------5.5.5.5[PAN3220]NAT-----10.100.100.10[VM PAN]   In this scenario - what would be an option for adding a second portal and gateway say for on demand saml based VPN? Add a loopback at a new private IP say 10.100.99.10 on a loopback and add a route to the PAN 3220 to reach it via 10.100.100.10 the outside of the VM PAN? And add a NAT at the 3220 say 5.5.5.6->10.100.99.10?  Or add the NAT at the VM PAN say 10.100.100.15 - > 10.100.99.10 (on say Lo1)?    Thank you.   ... View more

If I wanted to force testing the certificate and make sure the cookie wasn't being used to extend an old connection,  is there a means of manually deleting the Global Protect cookie on a client machine? ... View more

I am having some users who experience Connection Failed for the certificate auth Global Protect session. What are the top 4 or 5 things I should look for in Global Protect debug logs to pin down what's  behind this message?     On the back PAN side I am observing these steps in Monitor/Global Protect Logging for a good login:   Portal Pre-Login Portal Auth   (Cert) Portal Get Config GP_CLient Prelogin Machine Cert Gateway Prelogin Gateway Auth (sometimes cookie) Gateway Register Gateway Get Config (Client-Config – IP assigned) Gateway Setup SSL Gateway Connected Gateway tunnel latency Gateway hip check ... View more

I know have a VM300 NGFW installed and registered in my private vCenter environment. The reason for the VM300 is to provide more Global Protect users a means to connect to the network than the 1024 connections afforded by the 3220 PAN at the edge. My question has to do with addressing and zoning of the interfaces on the VM300 and NATting to the Internet.    1) Can I add a 1:1 NAT on the 3220 that would map to the "OUTSIDE" of the VM300 (which is inside the PAN 3220)? So say currently the outside address of the 3220 is 1.1.1.100 and that serves as the address for the existing portal and gateway too. We'll say the inside of the PAN 3220 is at 10.10.10.100. If we made the "Outside" of the of the VM300 to be at say 10.10.10.200, could we create a NAT on the 3220 such that 1.1.1.200 NATted to 10.10.10.200 and have this work for the purposes of a GP gateway?   2) Would it be preferable for the VM300 to have it's OUTSIDE interface on a DMZ VLAN off of the 3220 and then have its inside interface be placed on the internal network? So in this scenario the VM300 OUTSIDE interface has IP 10.10.20.200 and that NATs to 1.1.1.200 on the 3220 OUTSIDE.  To summarize: Can one hardware PAN serve as the NAT and routing conduit to and internal VM PAN that will act as a secondary GP gateway to the former? And what would be the preferred layout of the interfaces of the VM PAN in such a scenario?  Thank you. ... View more

I am trying to setup my first VM PAN. After activating my credits I was able to see 10.x PAN OS OVA in software. I've downloaded that and will get that installed in VMW. But when I look to register the firewall, I am only seeing PAN OS options up to 9.1. Did I make a wrong chose when creating the deployment profile? I seem to recall there were top options - one was Any PAN OS (chosen) or 10.something. Should I delete the profile and recreate it? Or is that not necessary?  ... View more