About DonohoeRobert

Hi Mate,   No worries at all..    Ye need to create a tunnel interface here 100%. Gateway and portal on loopback interface is grand, but would enable tunnel mode as per normal as well.    Let us know how it goes, article a little old but can mock up in the lab again if needed.   best regards   Rob  ... View more

HI Mate,    They are IP address's not URL's/FQDN's If creating rules and ever not sure what category a urll or address is from the cli do a test cmd. Below is a test cmd for google.com   >test url google.com .    https://live.paloaltonetworks.com/t5/Management-Articles/Complete-List-of-PAN-DB-URL-Filtering-Categories/ta-p/129799   best regards,   Rob   ... View more

Hi Guys,    Interesting one, tested again on 8.0.7 , no joy for android 6. IOS devices connect fine with the xauth. Client works best always anyways if the licence.  Have ye tried cert authentication for the androids on 6.0. Will check tomorrow, but with the cert based auth/client certs can have sha 256 if androids need that.  Might be a workaround to get ye out of the woods.  The gp client connects fine anyways, no licence needed for the gp client on version 8 on windows or macbooks. and IOS devices connecting fine using xauth from a quick check.. best regards,   Rob  ... View more

Hi Mate,    Using Macs with gp - 10.13.2 and gp clients 4.0.5-8. Have no issue connecting through GP and reaching remote servers when working from home. Connect to multiple different gp networks regularly from mac, and servers over rdp of https type connections.   Out of interest, if ye block udp4051 connections, so the tunnels established as ssl, do ye have the same issue ? As always if causing a production impact open a case with your support partner.    cheers   Rob        ... View more

Hi mate,   possible in the one rule if creative with the order of precedence for url filtering.     check out the order of precednce below..    block yer blocks in the block list not custom category and allow yer allows in the allow list or custom categories whitelist.    https://live.paloaltonetworks.com/t5/Management-Articles/URL-Filtering-Order/ta-p/59334 https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Create-Custom-URL-Categories/ta-p/54355     cheers   Rob  ... View more

Hi Mate,    There is a link showing what ports [tcp/udp] are needed for the echo.    https://www.amazon.com/gp/help/customer/display.html?nodeId=201973870   ye can create services for these and apply to a service group, then use that service group instead of a 'any' in the services. Monitor the traffic going through it for a day after ye test it, and from the ACC tab, filter by sorce IP and look at the applications the echo used. Can add them to the rule then.    best regards,   Rob  ... View more

Hi Mate,    Apart from the user id, zones and security rules. Ye can go one step further with hip checks to look at the devices connecting.    Can use the hip profiles in conjunction with the user id, zones etc, to make sure the devices connecting are above board and not just the user's credentials 🙂     https://www.paloaltonetworks.com/documentation/71/globalprotect/globalprotect-admin-guide/use-host-information-in-policy-enforcement/configure-hip-based-policy-enforcement     https://live.paloaltonetworks.com/t5/Featured-Articles/DotW-HIP-checks-for-missing-patches-for-multiple-vendors-on-one/ta-p/73814   details of what can be checked with the hip checks are below.      hope this helps,    Rob    ... View more

Hi Mate,    Looks like the gateway and mgt ip are the same 🙂   whatever the correct gateway is use that and use something different for the mgt ip.    cheers    rob      ... View more

hi mate,    there is a link below with a tech doc on this.    https://live.paloaltonetworks.com/t5/Tech-Note-Articles/Configuring-route-based-IPSec-with-overlapping-networks/ta-p/53337   cheers,    Rob ... View more

Hi Mate,    Always another way to skin a cat. Can block all http posts, which is what phishing sites rely on. Can obviously allow for some as per requirments. But a block of http posts on unknown sites with a custom signature could save you alot of time.    is an old doc below;  https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Block-All-HTTP-POST-Requests/ta-p/53704   hope it helps,    rob  ... View more

Hi Mate,    Would trust the migration tool. Its checking the xml for occurrances of the named object. If its not in the config it highlights it.  There's another handy bit of kit called the configurator. If you can get you head around the coding its very useful. There's one cmd to delete all unused objects. If ye can delete them ye can probably parse them as well. All depends on how many ye have. 10 / 20 can check manually in the xml file yer self. 100's or 1000's maybe try sus out the configurator..    https://live.paloaltonetworks.com/t5/General-Topics/Pan-Configurator-service-edit-php/m-p/169839#M53921   https://github.com/cpainchaud/pan-configurator   is open source, as far as I know a pan engineer developed it and maintains it..    some example of the code below  Delete unused objects from a config : foreach ( $pan -> addressStore -> addressObjects() as $object ) if ( $object -> countReferences() == 0 ) $pan -> addressStore -> remove( $object ); Want to know where an object is used ? $object = $pan -> addressStore -> find( ' H-WebServer4 ' ); foreach ( $object -> getReferences() as $ref ) print $ref -> toString() . " \n " ;   cheers   rob  ... View more

Hi Mate,    If ye have monitoring set up, the system log has tunnel up / tunnel down. Article below shows how to get details using cli  https://live.paloaltonetworks.com/t5/Management-Articles/Which-Logs-are-Generated-When-a-Monitor-Detects-Tunnel-is-Down/ta-p/62770 also has cool way to summarize it to clearly see how log a tunnel is up or down 🙂     cheers   Rob  ... View more

Hi Mate,    someone may correct me, but looking at the logs..    1. yes different things altogether.. ones for the gp ones for site to sites. 2. yes. Even though they are two different connection methods they end up negotiating and establishing tunnels based on the crypto settings in the gp profile.            tail end of the xauth auth, ends up with same crypto,              xauth connecting below..    2017-11-21 00:02:46.171 +0000 [INFO]: {1000001: }: GP gateway gwGP-N domain user robert (e35a0e6d71847f22394aafbce8751a44) from 10.10.20.102 login rtn 1 lifetime 3600 2017-11-21 00:02:46.172 +0000 [DEBG]: {1000001: }: sending command to sw.rasmgr.sslvpn.client_config: <request><gp-ike> <client-config> <portal>gwGP-N</portal> <protocol-version>IKE</protocol-version> <app-version>Cisco Systems VPN Client</app-version> <client-os-version>iPhone OS:11.1.2</client-os-version> <client-type>4</client-type> <user>robert</user> <authcookie>e35a0e6d71847f22394aafbce8751a44</authcookie> </client-config> </gp-ike></request> 2017-11-21 00:02:46.178 +0000 [DEBG]: {1000001: }: response: <response status="success"> <need-tunnel>yes</need-tunnel> <ssl-tunnel-url>/ssl-tunnel-connect.sslvpn</ssl-tunnel-url> <portal>gwGP-N</portal> <user>robert</user> <lifetime>2592000</lifetime> <timeout>10800</timeout> <disconnect-on-idle>10800</disconnect-on-idle> <bw-c2s>1000</bw-c2s> <bw-s2c>1000</bw-s2c> <gw-address>10.10.24.1</gw-address> <ip-address>10.10.30.124</ip-address> <netmask>255.255.255.255</netmask> <dns> <member>10.10.30.1</member> </dns> <wins> </wins> <dns-suffix> </dns-suffix> <default-gateway>10.10.30.124</default-gateway> <mtu>0</mtu> <no-direct-access-to-local-network>no</no-direct-access-to-local-network> <access-routes> <member>0.0.0.0/0</member> </access-routes> <exclude-access-routes> </exclude-access-routes> </response> 2017-11-21 00:02:46.178 +0000 [DEBG]: {1000001: }: Attribute INTERNAL_IP4_ADDRESS, len 0 2017-11-21 00:02:46.178 +0000 [DEBG]: {1000001: }: Attribute INTERNAL_IP4_NETMASK, len 0 2017-11-21 00:02:46.178 +0000 [DEBG]: {1000001: }: Attribute INTERNAL_IP4_DNS, len 0 2017-11-21 00:02:46.178 +0000 [DEBG]: {1000001: }: Attribute INTERNAL_IP4_NBNS, len 0 2017-11-21 00:02:46.178 +0000 [DEBG]: {1000001: }: Attribute INTERNAL_ADDRESS_EXPIRY, len 0 2017-11-21 00:02:46.178 +0000 [PWRN]: {1000001: }: Ignored attribute INTERNAL_ADDRESS_EXPIRY 2017-11-21 00:02:46.178 +0000 [DEBG]: {1000001: }: Attribute APPLICATION_VERSION, len 41 2017-11-21 00:02:46.184 +0000 [DEBG]: {1000001: }: Attribute UNITY_BANNER, len 0 2017-11-21 00:02:46.184 +0000 [DEBG]: {1000001: }: Attribute UNITY_DEF_DOMAIN, len 0 2017-11-21 00:02:46.184 +0000 [DEBG]: {1000001: }: Attribute UNITY_SPLITDNS_NAME, len 0 2017-11-21 00:02:46.184 +0000 [DEBG]: {1000001: }: Attribute UNITY_SPLIT_INCLUDE, len 0 2017-11-21 00:02:46.184 +0000 [DEBG]: {1000001: }: Attribute UNITY_LOCAL_LAN, len 0 2017-11-21 00:02:46.184 +0000 [DEBG]: {1000001: }: Attribute UNITY_PFS, len 0 2017-11-21 00:02:46.184 +0000 [DEBG]: {1000001: }: Attribute UNITY_SAVE_PASSWD, len 0 2017-11-21 00:02:46.184 +0000 [DEBG]: {1000001: }: Attribute UNITY_FW_TYPE, len 0 2017-11-21 00:02:46.184 +0000 [DEBG]: {1000001: }: Ignored attribute 28680 2017-11-21 00:02:46.184 +0000 [DEBG]: {1000001: }: Attribute UNITY_BACKUP_SERVERS, len 0 2017-11-21 00:02:46.184 +0000 [DEBG]: {1000001: }: Ignored attribute 28681 2017-11-21 00:02:46.184 +0000 [DEBG]: {1000001: }: Attribute UNITY_BROWSER_PROXY, len 0 2017-11-21 00:02:46.184 +0000 [PWRN]: {1000001: }: Ignored attribute UNITY_BROWSER_PROXY 2017-11-21 00:02:46.184 +0000 [DEBG]: {1000001: }: Sending MODE_CFG REPLY 2017-11-21 00:02:46.184 +0000 [DEBG]: {1000001: }: HASH with: 2017-11-21 00:02:46.184 +0000 [DUMP]: 9c0b18a7 00000042 02007b4e 00010004 0a0a1e7c 00020004 ffffffff 00030004 0a0a1e01 0007000c 50414e4f 5320382e 302e3600 70020001 00700300 0100f007 0000f001 0001 2017-11-21 00:02:46.184 +0000 [DEBG]: {1000001: }: hmac(hmac_sha2_256) 2017-11-21 00:02:46.184 +0000 [DEBG]: {1000001: }: HASH computed: 2017-11-21 00:02:46.184 +0000 [DUMP]: 67fb16c7 848ce6e0 8d881049 62d59001 4ea8261a bace29cd 02198679 c2827cf9 2017-11-21 00:02:46.184 +0000 [DEBG]: {1000001: }: MODE_CFG packet to send 2017-11-21 00:02:46.185 +0000 [DUMP]: fca4e2f2 4fbe4aff f665c10c b7f08135 08100601 9c0b18a7 00000082 0e000024 67fb16c7 848ce6e0 8d881049 62d59001 4ea8261a bace29cd 02198679 c2827cf9 00000042 02007b4e 00010004 0a0a1e7c 00020004 ffffffff 00030004 0a0a1e01 0007000c 50414e4f 5320382e 302e3600 70020001 00700300 0100f007 0000f001 0001 2017-11-21 00:02:46.185 +0000 [DEBG]: {1000001: }: begin encryption. 2017-11-21 00:02:46.185 +0000 [DEBG]: {1000001: }: encryption(aes) 2017-11-21 00:02:46.185 +0000 [DEBG]: {1000001: }: pad length = 10 2017-11-21 00:02:46.185 +0000 [DUMP]: 0e000024 67fb16c7 848ce6e0 8d881049 62d59001 4ea8261a bace29cd 02198679 c2827cf9 00000042 02007b4e 00010004 0a0a1e7c 00020004 ffffffff 00030004 0a0a1e01 0007000c 50414e4f 5320382e 302e3600 70020001 00700300 0100f007 0000f001 00016051 70389164 418fee0a 2017-11-21 00:02:46.185 +0000 [DEBG]: {1000001: }: encryption(aes) 2017-11-21 00:02:46.185 +0000 [DEBG]: {1000001: }: with key: 2017-11-21 00:02:46.185 +0000 [DUMP]: 543cccd5 9075082b 1ce7154a b097db71 90265b2e 50b3b942 ccef9915 774d713c 2017-11-21 00:02:46.185 +0000 [DEBG]: {1000001: }: encrypted payload by IV: 2017-11-21 00:02:46.185 +0000 [DUMP]: 029e9573 b2faa51b da217b95 cb294d56 2017-11-21 00:02:46.185 +0000 [DEBG]: {1000001: }: save IV for next: 2017-11-21 00:02:46.185 +0000 [DUMP]: 0a712906 a5ecfd7f 50ee98e3 4deb62f2 2017-11-21 00:02:46.185 +0000 [DEBG]: {1000001: }: encrypted. 2017-11-21 00:02:46.185 +0000 [DEBG]: {1000001: }: 140 bytes from 10.10.24.1[500] to 10.10.20.102[500] 2017-11-21 00:02:46.185 +0000 [DEBG]: 10.10.24.1[500] - 10.10.20.102[500]:(nil) 1 times of 140 bytes message will be sent over socket 1024 2017-11-21 00:02:46.185 +0000 [DUMP]: fca4e2f2 4fbe4aff f665c10c b7f08135 08100601 9c0b18a7 0000008c 463a70d7 a94c56f3 299659fa 0bf8d264 f8305d18 0b2f967c da909f8f 02597871 e637f64b e47741f1 11161d56 fd5f356f bd7f8ecd 8d13b64e 22e98212 ffe8a760 204bb82d f45f69f1 374dcc8b 58a2f57c 28ccf90d b87b82ee 242948bd a41adcfb 0a712906 a5ecfd7f 50ee98e3 4deb62f2 2017-11-21 00:02:46.185 +0000 [DEBG]: {1000001: }: sendto mode config attr. 2017-11-21 00:02:46.186 +0000 [INFO]: disconnect user 3de1921f4221df0a329ac77d400d27a5 2017-11-21 00:02:46.186 +0000 [DEBG]: { : 1}: Deleting a Ph2... status 9 2017-11-21 00:02:46.186 +0000 [DEBG]: {1000001: }: compute IV for phase2 2017-11-21 00:02:46.186 +0000 [DEBG]: {1000001: }: phase1 last IV: 2017-11-21 00:02:46.186 +0000 [DUMP]: aef80e89 e8afa82f fa697c21 539ec9a6 65239de7 2017-11-21 00:02:46.186 +0000 [DEBG]: hash(sha256) 2017-11-21 00:02:46.186 +0000 [DEBG]: {1000001: }: encryption(aes) 2017-11-21 00:02:46.186 +0000 [DEBG]: {1000001: }: phase2 IV computed: 2017-11-21 00:02:46.186 +0000 [DUMP]: 9aab1f2b 746d1600 bc0db927 3f1872d2 2017-11-21 00:02:46.186 +0000 [DEBG]: {1000001: }: HASH with: 2017-11-21 00:02:46.186 +0000 [DUMP]: 65239de7 00000010 00000001 03040001 9a5beaf1 2017-11-21 00:02:46.186 +0000 [DEBG]: {1000001: }: hmac(hmac_sha2_256) 2017-11-21 00:02:46.186 +0000 [DEBG]: {1000001: }: HASH computed: 2017-11-21 00:02:46.186 +0000 [DUMP]: dbfd8088 56f13bff 955052c3 3cf989ee 1bb921ef 94dac02f dae75331 4a961824 2017-11-21 00:02:46.186 +0000 [DEBG]: {1000001: }: begin encryption. 2017-11-21 00:02:46.186 +0000 [DEBG]: {1000001: }: encryption(aes) 2017-11-21 00:02:46.186 +0000 [DEBG]: {1000001: }: pad length = 12 2017-11-21 00:02:46.187 +0000 [DUMP]: 0c000024 dbfd8088 56f13bff 955052c3 3cf989ee 1bb921ef 94dac02f dae75331 4a961824 00000010 00000001 03040001 9a5beaf1 fcd8c41a 59ba2f37 2bc9d00c 2017-11-21 00:02:46.187 +0000 [DEBG]: {1000001: }: encryption(aes) 2017-11-21 00:02:46.187 +0000 [DEBG]: {1000001: }: with key: 2017-11-21 00:02:46.187 +0000 [DUMP]: 543cccd5 9075082b 1ce7154a b097db71 90265b2e 50b3b942 ccef9915 774d713c 2017-11-21 00:02:46.187 +0000 [DEBG]: {1000001: }: encrypted payload by IV: 2017-11-21 00:02:46.187 +0000 [DUMP]: 9aab1f2b 746d1600 bc0db927 3f1872d2 2017-11-21 00:02:46.187 +0000 [DEBG]: {1000001: }: save IV for next: 2017-11-21 00:02:46.187 +0000 [DUMP]: 963049c1 6ac1343f 948d2ba4 84f412e0 2017-11-21 00:02:46.187 +0000 [DEBG]: {1000001: }: encrypted. 2017-11-21 00:02:46.187 +0000 [DEBG]: {1000001: }: 92 bytes from 10.10.24.1[500] to 10.10.20.102[500] 2017-11-21 00:02:46.187 +0000 [DEBG]: 10.10.24.1[500] - 10.10.20.102[500]:(nil) 1 times of 92 bytes message will be sent over socket 1024 2017-11-21 00:02:46.187 +0000 [DUMP]: fca4e2f2 4fbe4aff f665c10c b7f08135 08100501 65239de7 0000005c 4439031e 97a40663 d527a407 36368038 04c2dbe6 b43e8425 81b77b00 86b13c2c f2dc4eba 014a0e82 b82cde10 6f43b469 963049c1 6ac1343f 948d2ba4 84f412e0 2017-11-21 00:02:46.187 +0000 [DEBG]: {1000001: }: sendto Information delete. 2017-11-21 00:02:46.188 +0000 [DEBG]: IV freed 2017-11-21 00:02:46.189 +0000 [DUMP]: { : 1}: proto 3 spi 0x9a5beaf1 2017-11-21 00:02:46.189 +0000 [PNTF]: { : 1}: ====> IPSEC KEY DELETED <==== ====> Deleted SA: 10.10.24.1[500]-10.10.20.102[500] SPI:0x9A5BEAF1/0x09B5AE88 <==== 2017-11-21 00:02:46.190 +0000 [INFO]: {1684353: 1}: SADB_DELETE proto=0 src=10.10.24.1[500] dst=10.10.20.102[500] ESP spi=0x9A5BEAF1 2017-11-21 00:02:46.192 +0000 [DEBG]: IV freed 2017-11-21 00:02:46.215 +0000 [DEBG]: processing isakmp packet 2017-11-21 00:02:46.215 +0000 [DEBG]: === 2017-11-21 00:02:46.215 +0000 [DEBG]: 300 bytes message received from 10.10.20.102[500] 2017-11-21 00:02:46.215 +0000 [DUMP]: fca4e2f2 4fbe4aff f665c10c b7f08135 08102001 ce87ce19 0000012c 57024d36 9ec5e4d2 bd057efa ff35197d d6816e58 fc5f2e3d e2ba72f1 57a8e910 8c80aa51 3db9eac3 722fcaad 60871c9b cd10c7de ff252e05 d9823bc4 728ba9a5 8074ee5c 1fbd0de1 47ff4f2f 4526d541 18f3fe6f ca907f1a f2f81118 ea7df3df 30c90457 b6b735dd 08adebcd 4711e34a a7047f1c 20c51536 82d35ba9 59d17a18 cfff66a6 2f676621 c2411009 f6fe5bfd db5bbe0d 95861a1d 53bae714 7fcf491e 7834f120 3ffe2cf4 53fbb54a 38bc9e67 d2ca6dd6 e82d38b9 b7f05040 b065b1a3 2254181e 466102ff 054bd23a 7f516421 333964dd c2dc8830 1230809b 0a689d60 e6f2e001 11d0c3f7 4c7ef2fd c88e7312 2158817b e258dea2 028b4c53 ea8ae976 cb071bef 51f820c7 4fcc473b 538a4459 2017-11-21 00:02:46.215 +0000 [DEBG]: chk packet 3b4c30e7:20 size 300, rcp 2, NF rc 0 2017-11-21 00:02:46.215 +0000 [DEBG]: {1000001: }: compute IV for phase2 2017-11-21 00:02:46.216 +0000 [DEBG]: {1000001: }: phase1 last IV: 2017-11-21 00:02:46.216 +0000 [DUMP]: aef80e89 e8afa82f fa697c21 539ec9a6 ce87ce19 2017-11-21 00:02:46.216 +0000 [DEBG]: hash(sha256) 2017-11-21 00:02:46.216 +0000 [DEBG]: {1000001: }: encryption(aes) 2017-11-21 00:02:46.216 +0000 [DEBG]: {1000001: }: phase2 IV computed: 2017-11-21 00:02:46.216 +0000 [DUMP]: 217e0ba1 0d3374ec 053ab2cf 4d443ebe 2017-11-21 00:02:46.216 +0000 [PNTF]: {1000001: }: ====> PHASE-2 NEGOTIATION STARTED AS RESPONDER, (QUICK MODE) <==== ====> Initiated SA: 10.10.24.1[500]-10.10.20.102[500] message id:0xCE87CE19 <==== 2017-11-21 00:02:46.217 +0000 [DEBG]: {1000001: }: begin decryption. 2017-11-21 00:02:46.217 +0000 [DEBG]: {1000001: }: encryption(aes) 2017-11-21 00:02:46.217 +0000 [DEBG]: {1000001: }: IV was saved for next processing: 2017-11-21 00:02:46.217 +0000 [DUMP]: cb071bef 51f820c7 4fcc473b 538a4459 2017-11-21 00:02:46.217 +0000 [DEBG]: {1000001: }: encryption(aes) 2017-11-21 00:02:46.217 +0000 [DEBG]: {1000001: }: with key: 2017-11-21 00:02:46.217 +0000 [DUMP]: 543cccd5 9075082b 1ce7154a b097db71 90265b2e 50b3b942 ccef9915 774d713c 2017-11-21 00:02:46.217 +0000 [DEBG]: {1000001: }: decrypted payload by IV: 2017-11-21 00:02:46.217 +0000 [DUMP]: 217e0ba1 0d3374ec 053ab2cf 4d443ebe 2017-11-21 00:02:46.217 +0000 [DEBG]: {1000001: }: decrypted payload, but not trimed. 2017-11-21 00:02:46.218 +0000 [DUMP]: 01000024 7981bc4b 75f4a9f2 e804f3e9 5e1df1a0 ceaeab8c b2f6ccca 462489bb 26455f24 0a0000b8 00000001 00000001 000000ac 01030406 066f0787 0300001c 010c0000 80010001 80020e10 80040001 80060100 80050002 0300001c 020c0000 80010001 80020e10 80040001 80060100 80050001 0300001c 030c0000 80010001 80020e10 80040001 80060080 80050002 0300001c 040c0000 80010001 80020e10 80040001 80060080 80050001 03000018 05030000 80010001 80020e10 80040001 80050002 00000018 06030000 80010001 80020e10 80040001 80050001 05000014 f1f5ff8a 93f0d284 188b4f4e dd15e61c 0500000c 01000000 0a0a1e7c 00000010 04000000 00000000 00000000 00000004 2017-11-21 00:02:46.218 +0000 [DEBG]: {1000001: }: padding len=4 2017-11-21 00:02:46.218 +0000 [DEBG]: {1000001: }: decrypted. 2017-11-21 00:02:46.218 +0000 [DUMP]: fca4e2f2 4fbe4aff f665c10c b7f08135 08102001 ce87ce19 0000012c 01000024 7981bc4b 75f4a9f2 e804f3e9 5e1df1a0 ceaeab8c b2f6ccca 462489bb 26455f24 0a0000b8 00000001 00000001 000000ac 01030406 066f0787 0300001c 010c0000 80010001 80020e10 80040001 80060100 80050002 0300001c 020c0000 80010001 80020e10 80040001 80060100 80050001 0300001c 030c0000 80010001 80020e10 80040001 80060080 80050002 0300001c 040c0000 80010001 80020e10 80040001 80060080 80050001 03000018 05030000 80010001 80020e10 80040001 80050002 00000018 06030000 80010001 80020e10 80040001 80050001 05000014 f1f5ff8a 93f0d284 188b4f4e dd15e61c 0500000c 01000000 0a0a1e7c 00000010 04000000 00000000 00000000 00000004 2017-11-21 00:02:46.218 +0000 [DEBG]: {1000001: }: begin. 2017-11-21 00:02:46.218 +0000 [DEBG]: {1000001: }: seen nptype=8(hash) 2017-11-21 00:02:46.218 +0000 [DEBG]: {1000001: }: seen nptype=1(sa) 2017-11-21 00:02:46.218 +0000 [DEBG]: {1000001: }: seen nptype=10(nonce) 2017-11-21 00:02:46.218 +0000 [DEBG]: {1000001: }: seen nptype=5(id) 2017-11-21 00:02:46.218 +0000 [DEBG]: {1000001: }: seen nptype=5(id) 2017-11-21 00:02:46.218 +0000 [DEBG]: {1000001: }: succeed. 2017-11-21 00:02:46.218 +0000 [DEBG]: {1000001: }: received IDci2: 2017-11-21 00:02:46.218 +0000 [DUMP]: 01000000 0a0a1e7c 2017-11-21 00:02:46.218 +0000 [DEBG]: {1000001: }: received IDcr2: 2017-11-21 00:02:46.218 +0000 [DUMP]: 04000000 00000000 00000000 2017-11-21 00:02:46.218 +0000 [DEBG]: {1000001: }: HASH(1) validate: 2017-11-21 00:02:46.218 +0000 [DUMP]: 7981bc4b 75f4a9f2 e804f3e9 5e1df1a0 ceaeab8c b2f6ccca 462489bb 26455f24 2017-11-21 00:02:46.218 +0000 [DEBG]: {1000001: }: HASH with: 2017-11-21 00:02:46.219 +0000 [DUMP]: ce87ce19 0a0000b8 00000001 00000001 000000ac 01030406 066f0787 0300001c 010c0000 80010001 80020e10 80040001 80060100 80050002 0300001c 020c0000 80010001 80020e10 80040001 80060100 80050001 0300001c 030c0000 80010001 80020e10 80040001 80060080 80050002 0300001c 040c0000 80010001 80020e10 80040001 80060080 80050001 03000018 05030000 80010001 80020e10 80040001 80050002 00000018 06030000 80010001 80020e10 80040001 80050001 05000014 f1f5ff8a 93f0d284 188b4f4e dd15e61c 0500000c 01000000 0a0a1e7c 00000010 04000000 00000000 00000000 2017-11-21 00:02:46.219 +0000 [DEBG]: {1000001: }: hmac(hmac_sha2_256) 2017-11-21 00:02:46.219 +0000 [DEBG]: {1000001: }: HASH computed: 2017-11-21 00:02:46.219 +0000 [DUMP]: 7981bc4b 75f4a9f2 e804f3e9 5e1df1a0 ceaeab8c b2f6ccca 462489bb 26455f24 2017-11-21 00:02:46.219 +0000 [DEBG]: encryption(3des) 2017-11-21 00:02:46.219 +0000 [DEBG]: encryption(3des) 2017-11-21 00:02:46.219 +0000 [DEBG]: encryption(3des) 2017-11-21 00:02:46.219 +0000 [DEBG]: { : 1}: total SA len=180 2017-11-21 00:02:46.219 +0000 [DUMP]: 00000001 00000001 000000ac 01030406 066f0787 0300001c 010c0000 80010001 80020e10 80040001 80060100 80050002 0300001c 020c0000 80010001 80020e10 80040001 80060100 80050001 0300001c 030c0000 80010001 80020e10 80040001 80060080 80050002 0300001c 040c0000 80010001 80020e10 80040001 80060080 80050001 03000018 05030000 80010001 80020e10 80040001 80050002 00000018 06030000 80010001 80020e10 80040001 80050001 2017-11-21 00:02:46.219 +0000 [DEBG]: begin. 2017-11-21 00:02:46.219 +0000 [DEBG]: seen nptype=2(prop) 2017-11-21 00:02:46.219 +0000 [DEBG]: succeed. 2017-11-21 00:02:46.219 +0000 [DEBG]: { : 1}: proposal #1 len=172 2017-11-21 00:02:46.219 +0000 [DEBG]: begin. 2017-11-21 00:02:46.219 +0000 [DEBG]: seen nptype=3(trns) 2017-11-21 00:02:46.219 +0000 [DEBG]: seen nptype=3(trns) 2017-11-21 00:02:46.219 +0000 [DEBG]: seen nptype=3(trns) 2017-11-21 00:02:46.219 +0000 [DEBG]: seen nptype=3(trns) 2017-11-21 00:02:46.219 +0000 [DEBG]: seen nptype=3(trns) 2017-11-21 00:02:46.219 +0000 [DEBG]: seen nptype=3(trns) 2017-11-21 00:02:46.219 +0000 [DEBG]: succeed. 2017-11-21 00:02:46.219 +0000 [DEBG]: { : 1}: transform #1 len=28 2017-11-21 00:02:46.219 +0000 [DEBG]: { : 1}: type=SA Life Type, flag=0x8000, lorv=seconds 2017-11-21 00:02:46.219 +0000 [DEBG]: { : 1}: type=SA Life Duration, flag=0x8000, lorv=3600 2017-11-21 00:02:46.219 +0000 [DEBG]: { : 1}: life duration was in TLV. 2017-11-21 00:02:46.219 +0000 [DEBG]: { : 1}: type=Encryption Mode, flag=0x8000, lorv=Tunnel 2017-11-21 00:02:46.219 +0000 [DEBG]: { : 1}: type=Key Length, flag=0x8000, lorv=256 2017-11-21 00:02:46.219 +0000 [DEBG]: { : 1}: type=Authentication Algorithm, flag=0x8000, lorv=hmac-sha 2017-11-21 00:02:46.219 +0000 [DEBG]: { : 1}: transform #2 len=28 2017-11-21 00:02:46.219 +0000 [DEBG]: { : 1}: type=SA Life Type, flag=0x8000, lorv=seconds 2017-11-21 00:02:46.219 +0000 [DEBG]: { : 1}: type=SA Life Duration, flag=0x8000, lorv=3600 2017-11-21 00:02:46.219 +0000 [DEBG]: { : 1}: life duration was in TLV. 2017-11-21 00:02:46.219 +0000 [DEBG]: { : 1}: type=Encryption Mode, flag=0x8000, lorv=Tunnel 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: type=Key Length, flag=0x8000, lorv=256 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: type=Authentication Algorithm, flag=0x8000, lorv=hmac-md5 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: transform #3 len=28 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: type=SA Life Type, flag=0x8000, lorv=seconds 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: type=SA Life Duration, flag=0x8000, lorv=3600 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: life duration was in TLV. 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: type=Encryption Mode, flag=0x8000, lorv=Tunnel 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: type=Key Length, flag=0x8000, lorv=128 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: type=Authentication Algorithm, flag=0x8000, lorv=hmac-sha 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: transform #4 len=28 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: type=SA Life Type, flag=0x8000, lorv=seconds 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: type=SA Life Duration, flag=0x8000, lorv=3600 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: life duration was in TLV. 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: type=Encryption Mode, flag=0x8000, lorv=Tunnel 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: type=Key Length, flag=0x8000, lorv=128 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: type=Authentication Algorithm, flag=0x8000, lorv=hmac-md5 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: transform #5 len=24 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: type=SA Life Type, flag=0x8000, lorv=seconds 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: type=SA Life Duration, flag=0x8000, lorv=3600 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: life duration was in TLV. 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: type=Encryption Mode, flag=0x8000, lorv=Tunnel 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: type=Authentication Algorithm, flag=0x8000, lorv=hmac-sha 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: transform #6 len=24 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: type=SA Life Type, flag=0x8000, lorv=seconds 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: type=SA Life Duration, flag=0x8000, lorv=3600 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: life duration was in TLV. 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: type=Encryption Mode, flag=0x8000, lorv=Tunnel 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: type=Authentication Algorithm, flag=0x8000, lorv=hmac-md5 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: pair 1: 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: 0xffdc000ba0: next=(nil) tnext=0xffdc003cd0 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: 0xffdc003cd0: next=(nil) tnext=0xffdc003d00 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: 0xffdc003d00: next=(nil) tnext=0xffdc003df0 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: 0xffdc003df0: next=(nil) tnext=0xffdc003e20 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: 0xffdc003e20: next=(nil) tnext=0xffdc003e50 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: 0xffdc003e50: next=(nil) tnext=(nil) 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: proposal #1: 6 transform 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: begin compare proposals. 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: pair[1]: 0xffdc000ba0 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: 0xffdc000ba0: next=(nil) tnext=0xffdc003cd0 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: 0xffdc003cd0: next=(nil) tnext=0xffdc003d00 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: 0xffdc003d00: next=(nil) tnext=0xffdc003df0 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: 0xffdc003df0: next=(nil) tnext=0xffdc003e20 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: 0xffdc003e20: next=(nil) tnext=0xffdc003e50 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: 0xffdc003e50: next=(nil) tnext=(nil) 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: prop#=1 prot-id=ESP spi-size=4 #trns=6 trns#=1 trns-id=AES 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: type=SA Life Type, flag=0x8000, lorv=seconds 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: type=SA Life Duration, flag=0x8000, lorv=3600 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: lifetime 3600 seconds 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: type=Encryption Mode, flag=0x8000, lorv=Tunnel 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: type=Key Length, flag=0x8000, lorv=256 2017-11-21 00:02:46.220 +0000 [DEBG]: { : 1}: type=Authentication Algorithm, flag=0x8000, lorv=hmac-sha 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: prop#=1 prot-id=ESP spi-size=4 #trns=6 trns#=2 trns-id=AES 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: type=SA Life Type, flag=0x8000, lorv=seconds 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: type=SA Life Duration, flag=0x8000, lorv=3600 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: lifetime 3600 seconds 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: type=Encryption Mode, flag=0x8000, lorv=Tunnel 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: type=Key Length, flag=0x8000, lorv=256 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: type=Authentication Algorithm, flag=0x8000, lorv=hmac-md5 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: prop#=1 prot-id=ESP spi-size=4 #trns=6 trns#=3 trns-id=AES 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: type=SA Life Type, flag=0x8000, lorv=seconds 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: type=SA Life Duration, flag=0x8000, lorv=3600 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: lifetime 3600 seconds 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: type=Encryption Mode, flag=0x8000, lorv=Tunnel 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: type=Key Length, flag=0x8000, lorv=128 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: type=Authentication Algorithm, flag=0x8000, lorv=hmac-sha 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: prop#=1 prot-id=ESP spi-size=4 #trns=6 trns#=4 trns-id=AES 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: type=SA Life Type, flag=0x8000, lorv=seconds 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: type=SA Life Duration, flag=0x8000, lorv=3600 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: lifetime 3600 seconds 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: type=Encryption Mode, flag=0x8000, lorv=Tunnel 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: type=Key Length, flag=0x8000, lorv=128 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: type=Authentication Algorithm, flag=0x8000, lorv=hmac-md5 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: prop#=1 prot-id=ESP spi-size=4 #trns=6 trns#=5 trns-id=3DES 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: type=SA Life Type, flag=0x8000, lorv=seconds 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: type=SA Life Duration, flag=0x8000, lorv=3600 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: lifetime 3600 seconds 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: type=Encryption Mode, flag=0x8000, lorv=Tunnel 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: type=Authentication Algorithm, flag=0x8000, lorv=hmac-sha 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: prop#=1 prot-id=ESP spi-size=4 #trns=6 trns#=6 trns-id=3DES 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: type=SA Life Type, flag=0x8000, lorv=seconds 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: type=SA Life Duration, flag=0x8000, lorv=3600 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: lifetime 3600 seconds 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: type=Encryption Mode, flag=0x8000, lorv=Tunnel 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: type=Authentication Algorithm, flag=0x8000, lorv=hmac-md5 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: peer's single bundle: 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: (proto_id=ESP spisize=4 spi=066f0787 spi_p=00000000 encmode=Tunnel reqid=0:0) 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: (trns_id=AES encklen=256 authtype=hmac-sha) 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: (trns_id=AES encklen=256 authtype=hmac-md5) 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: (trns_id=AES encklen=128 authtype=hmac-sha) 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: (trns_id=AES encklen=128 authtype=hmac-md5) 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: (trns_id=3DES encklen=0 authtype=hmac-sha) 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: (trns_id=3DES encklen=0 authtype=hmac-md5) 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: my single bundle: 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: (proto_id=ESP spisize=4 spi=00000000 spi_p=00000000 encmode=Tunnel reqid=0:0) 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: (trns_id=AES encklen=256 authtype=hmac-sha512) 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: (trns_id=AES encklen=128 authtype=hmac-sha512) 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: (trns_id=3DES encklen=192 authtype=hmac-sha512) 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: (trns_id=3DES encklen=0 authtype=hmac-sha512) 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: (trns_id=AES encklen=256 authtype=hmac-sha256) 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: (trns_id=AES encklen=128 authtype=hmac-sha256) 2017-11-21 00:02:46.221 +0000 [DEBG]: { : 1}: (trns_id=3DES encklen=192 authtype=hmac-sha256) 2017-11-21 00:02:46.222 +0000 [DEBG]: { : 1}: (trns_id=3DES encklen=0 authtype=hmac-sha256) 2017-11-21 00:02:46.222 +0000 [DEBG]: { : 1}: (trns_id=AES encklen=256 authtype=hmac-sha) 2017-11-21 00:02:46.222 +0000 [DEBG]: { : 1}: (trns_id=AES encklen=128 authtype=hmac-sha) 2017-11-21 00:02:46.222 +0000 [DEBG]: { : 1}: (trns_id=3DES encklen=192 authtype=hmac-sha) 2017-11-21 00:02:46.222 +0000 [DEBG]: { : 1}: (trns_id=3DES encklen=0 authtype=hmac-sha) 2017-11-21 00:02:46.222 +0000 [DEBG]: {1000001: }: authtype mismatched: my:hmac-sha512 peer:hmac-sha 2017-11-21 00:02:46.222 +0000 [DEBG]: {1000001: }: authtype mismatched: my:hmac-sha512 peer:hmac-sha 2017-11-21 00:02:46.222 +0000 [DEBG]: {1000001: }: trns_id mismatched: my:3DES peer:AES 2017-11-21 00:02:46.222 +0000 [DEBG]: {1000001: }: trns_id mismatched: my:3DES peer:AES 2017-11-21 00:02:46.222 +0000 [DEBG]: {1000001: }: authtype mismatched: my:hmac-sha256 peer:hmac-sha 2017-11-21 00:02:46.222 +0000 [DEBG]: {1000001: }: authtype mismatched: my:hmac-sha256 peer:hmac-sha 2017-11-21 00:02:46.222 +0000 [DEBG]: {1000001: }: trns_id mismatched: my:3DES peer:AES 2017-11-21 00:02:46.222 +0000 [DEBG]: {1000001: }: trns_id mismatched: my:3DES peer:AES 2017-11-21 00:02:46.222 +0000 [DEBG]: { : 1}: matched 2017-11-21 00:02:46.222 +0000 [DEBG]: { : 1}: === 2017-11-21 00:02:46.222 +0000 [DEBG]: {1000001: 1}: pfkey getspi sent. 2017-11-21 00:02:46.222 +0000 [DEBG]: { : 1}: call pfkey_send_getspi 2017-11-21 00:02:46.222 +0000 [DUMP]: sadb_getspi: seq=2, satype=141 2017-11-21 00:02:46.222 +0000 [DUMP]: sadb_getspi_callback: seq=2, spi=0xA884ECD1, satype=141, sa_src=0.0.0.0[500], sa_dst=10.10.24.1[500] 2017-11-21 00:02:46.222 +0000 [DEBG]: { : 1}: pfkey GETSPI succeeded: ESP/Tunnel 10.10.20.102[500]->10.10.24.1[500] spi=2827283665(0xa884ecd1) 2017-11-21 00:02:46.222 +0000 [DEBG]: { : 1}: total SA len=48 2017-11-21 00:02:46.222 +0000 [DUMP]: 00000001 00000001 00000028 01030401 00000000 0000001c 010c0000 80010001 80020e10 80040001 80060100 80050002 2017-11-21 00:02:46.222 +0000 [DEBG]: begin. 2017-11-21 00:02:46.222 +0000 [DEBG]: seen nptype=2(prop) 2017-11-21 00:02:46.222 +0000 [DEBG]: succeed. 2017-11-21 00:02:46.222 +0000 [DEBG]: { : 1}: proposal #1 len=40 2017-11-21 00:02:46.222 +0000 [DEBG]: begin. 2017-11-21 00:02:46.222 +0000 [DEBG]: seen nptype=3(trns) 2017-11-21 00:02:46.222 +0000 [DEBG]: succeed. 2017-11-21 00:02:46.222 +0000 [DEBG]: { : 1}: transform #1 len=28 2017-11-21 00:02:46.222 +0000 [DEBG]: { : 1}: type=SA Life Type, flag=0x8000, lorv=seconds 2017-11-21 00:02:46.222 +0000 [DEBG]: { : 1}: type=SA Life Duration, flag=0x8000, lorv=3600 2017-11-21 00:02:46.222 +0000 [DEBG]: { : 1}: life duration was in TLV. 2017-11-21 00:02:46.222 +0000 [DEBG]: { : 1}: type=Encryption Mode, flag=0x8000, lorv=Tunnel 2017-11-21 00:02:46.222 +0000 [DEBG]: { : 1}: type=Key Length, flag=0x8000, lorv=256 2017-11-21 00:02:46.222 +0000 [DEBG]: { : 1}: type=Authentication Algorithm, flag=0x8000, lorv=hmac-sha 2017-11-21 00:02:46.222 +0000 [DEBG]: { : 1}: pair 1: 2017-11-21 00:02:46.222 +0000 [DEBG]: { : 1}: 0xffdc000f10: next=(nil) tnext=(nil) 2017-11-21 00:02:46.222 +0000 [DEBG]: { : 1}: proposal #1: 1 transform 2017-11-21 00:02:46.222 +0000 [DEBG]: {1000001: 1}: add payload of len 48, next type 10(nonce) 2017-11-21 00:02:46.222 +0000 [DEBG]: {1000001: 1}: add payload of len 16, next type 5(id) 2017-11-21 00:02:46.222 +0000 [DEBG]: {1000001: 1}: add payload of len 8, next type 5(id) 2017-11-21 00:02:46.222 +0000 [DEBG]: {1000001: 1}: add payload of len 12, next type 0(none) 2017-11-21 00:02:46.222 +0000 [DEBG]: {1000001: }: HASH with: 2017-11-21 00:02:46.223 +0000 [DUMP]: ce87ce19 f1f5ff8a 93f0d284 188b4f4e dd15e61c 0a000034 00000001 00000001 00000028 01030401 a884ecd1 0000001c 010c0000 80010001 80020e10 80040001 80060100 80050002 05000014 0b4b7d18 4c77efb5 43fbb3ef 82c5efb5 0500000c 01000000 0a0a1e7c 00000010 04000000 00000000 00000000 2017-11-21 00:02:46.223 +0000 [DEBG]: {1000001: }: hmac(hmac_sha2_256) 2017-11-21 00:02:46.223 +0000 [DEBG]: {1000001: }: HASH computed: 2017-11-21 00:02:46.223 +0000 [DUMP]: 9ced2010 4eefd36c e2a48ee8 1cf5e012 75a7056b ec9538f1 3fb88e00 2aeb43e9 2017-11-21 00:02:46.223 +0000 [DEBG]: {1000001: 1}: add payload of len 32, next type 1(sa) 2017-11-21 00:02:46.223 +0000 [DEBG]: {1000001: }: begin encryption. 2017-11-21 00:02:46.223 +0000 [DEBG]: {1000001: }: encryption(aes) 2017-11-21 00:02:46.223 +0000 [DEBG]: {1000001: }: pad length = 8 2017-11-21 00:02:46.223 +0000 [DUMP]: 01000024 9ced2010 4eefd36c e2a48ee8 1cf5e012 75a7056b ec9538f1 3fb88e00 2aeb43e9 0a000034 00000001 00000001 00000028 01030401 a884ecd1 0000001c 010c0000 80010001 80020e10 80040001 80060100 80050002 05000014 0b4b7d18 4c77efb5 43fbb3ef 82c5efb5 0500000c 01000000 0a0a1e7c 00000010 04000000 00000000 00000000 312d042a 34a62208 2017-11-21 00:02:46.223 +0000 [DEBG]: {1000001: }: encryption(aes) 2017-11-21 00:02:46.223 +0000 [DEBG]: {1000001: }: with key: 2017-11-21 00:02:46.223 +0000 [DUMP]: 543cccd5 9075082b 1ce7154a b097db71 90265b2e 50b3b942 ccef9915 774d713c 2017-11-21 00:02:46.223 +0000 [DEBG]: {1000001: }: encrypted payload by IV: 2017-11-21 00:02:46.223 +0000 [DUMP]: cb071bef 51f820c7 4fcc473b 538a4459 2017-11-21 00:02:46.223 +0000 [DEBG]: {1000001: }: save IV for next: 2017-11-21 00:02:46.223 +0000 [DUMP]: a220b9c9 9c6e63ca 2b6b382c 97b16e83 2017-11-21 00:02:46.223 +0000 [DEBG]: {1000001: }: encrypted. 2017-11-21 00:02:46.223 +0000 [DEBG]: { : 1}: resend phase2 packet fca4e2f24fbe4aff:f665c10cb7f08135:CE87CE19 2017-11-21 00:02:46.223 +0000 [DEBG]: {1000001: }: 172 bytes from 10.10.24.1[500] to 10.10.20.102[500] 2017-11-21 00:02:46.223 +0000 [DEBG]: 10.10.24.1[500] - 10.10.20.102[500]:(nil) 1 times of 172 bytes message will be sent over socket 1024 2017-11-21 00:02:46.224 +0000 [DUMP]: fca4e2f2 4fbe4aff f665c10c b7f08135 08102001 ce87ce19 000000ac a2273b6a 6c2f5e9e 9dc8df4d a0a0fc31 1805791e ba96a061 422cabcc 07f03fdf 16245843 56280160 ed6015b4 9ac2387b 5d98e93e 9006c31e a0ac1e5b d18bf3f8 0e7f3cee a8ea80c0 79a7113c d1c739c1 c49f348c 468fbdc0 c68195e7 cc650c0d e117e8ec 9532eaa1 1422f9a9 283ebbb6 c189faba 1dbe3efa 9c9db794 4da6c7b6 a220b9c9 9c6e63ca 2b6b382c 97b16e83 2017-11-21 00:02:46.224 +0000 [DEBG]: {1000001: 1}: add packet 3b4c30e7:20 size 300, rcp 3 2017-11-21 00:02:46.224 +0000 [DEBG]: { : 1}: pfkey GETSPI sent: ESP/Tunnel 0.0.0.0[500]->10.10.24.1[500] 2017-11-21 00:02:46.227 +0000 [DEBG]: processing isakmp packet 2017-11-21 00:02:46.227 +0000 [DEBG]: === 2017-11-21 00:02:46.227 +0000 [DEBG]: 76 bytes message received from 10.10.20.102[500] 2017-11-21 00:02:46.227 +0000 [DUMP]: fca4e2f2 4fbe4aff f665c10c b7f08135 08102001 ce87ce19 0000004c 7b4bbf7c 574ec50b 6aa647f2 b11910cd dcb155c7 4d01ad01 df87c8d0 a3ee5221 d59d34b8 deef8b2c b3532766 a0450a87 2017-11-21 00:02:46.228 +0000 [DEBG]: chk packet 8a9b4f9f:20 size 76, rcp 3, NF rc 0 2017-11-21 00:02:46.228 +0000 [DEBG]: {1000001: }: begin decryption. 2017-11-21 00:02:46.228 +0000 [DEBG]: {1000001: }: encryption(aes) 2017-11-21 00:02:46.228 +0000 [DEBG]: {1000001: }: IV was saved for next processing: 2017-11-21 00:02:46.228 +0000 [DUMP]: d59d34b8 deef8b2c b3532766 a0450a87 2017-11-21 00:02:46.228 +0000 [DEBG]: {1000001: }: encryption(aes) 2017-11-21 00:02:46.228 +0000 [DEBG]: {1000001: }: with key: 2017-11-21 00:02:46.228 +0000 [DUMP]: 543cccd5 9075082b 1ce7154a b097db71 90265b2e 50b3b942 ccef9915 774d713c 2017-11-21 00:02:46.228 +0000 [DEBG]: {1000001: }: decrypted payload by IV: 2017-11-21 00:02:46.228 +0000 [DUMP]: a220b9c9 9c6e63ca 2b6b382c 97b16e83 2017-11-21 00:02:46.228 +0000 [DEBG]: {1000001: }: decrypted payload, but not trimed. 2017-11-21 00:02:46.228 +0000 [DUMP]: 00000024 1233462e 70e2d790 3893ed6c aae44872 1a2c5c9d 96b00d52 acdab609 b1d668be 00000000 00000000 0000000c 2017-11-21 00:02:46.228 +0000 [DEBG]: {1000001: }: padding len=12 2017-11-21 00:02:46.228 +0000 [DEBG]: {1000001: }: decrypted. 2017-11-21 00:02:46.228 +0000 [DUMP]: fca4e2f2 4fbe4aff f665c10c b7f08135 08102001 ce87ce19 0000004c 00000024 1233462e 70e2d790 3893ed6c aae44872 1a2c5c9d 96b00d52 acdab609 b1d668be 00000000 00000000 0000000c 2017-11-21 00:02:46.228 +0000 [DEBG]: {1000001: }: begin. 2017-11-21 00:02:46.228 +0000 [DEBG]: {1000001: }: seen nptype=8(hash) 2017-11-21 00:02:46.228 +0000 [DEBG]: {1000001: }: succeed. 2017-11-21 00:02:46.228 +0000 [DEBG]: {1000001: 1}: HASH(3) validate: 2017-11-21 00:02:46.228 +0000 [DUMP]: 1233462e 70e2d790 3893ed6c aae44872 1a2c5c9d 96b00d52 acdab609 b1d668be 2017-11-21 00:02:46.228 +0000 [DEBG]: {1000001: }: HASH with: 2017-11-21 00:02:46.228 +0000 [DUMP]: 00ce87ce 19f1f5ff 8a93f0d2 84188b4f 4edd15e6 1c0b4b7d 184c77ef b543fbb3 ef82c5ef b5 2017-11-21 00:02:46.228 +0000 [DEBG]: {1000001: }: hmac(hmac_sha2_256) 2017-11-21 00:02:46.228 +0000 [DEBG]: {1000001: }: HASH computed: 2017-11-21 00:02:46.228 +0000 [DUMP]: 1233462e 70e2d790 3893ed6c aae44872 1a2c5c9d 96b00d52 acdab609 b1d668be 2017-11-21 00:02:46.228 +0000 [DEBG]: {1000001: 1}: add packet 8a9b4f9f:20 size 76, rcp 4 2017-11-21 00:02:46.228 +0000 [DEBG]: { : 1}: === 2017-11-21 00:02:46.228 +0000 [DEBG]: {1000001: 1}: KEYMAT compute with 2017-11-21 00:02:46.229 +0000 [DUMP]: 03a884ec d1f1f5ff 8a93f0d2 84188b4f 4edd15e6 1c0b4b7d 184c77ef b543fbb3 ef82c5ef b5 2017-11-21 00:02:46.229 +0000 [DEBG]: {1000001: }: hmac(hmac_sha2_256) 2017-11-21 00:02:46.229 +0000 [DEBG]: encryption(aes) 2017-11-21 00:02:46.229 +0000 [DEBG]: {1000001: 1}: encklen=256 authklen=160 2017-11-21 00:02:46.229 +0000 [DEBG]: {1000001: 1}: generating 768 bits of key (dupkeymat=3) 2017-11-21 00:02:46.229 +0000 [DEBG]: {1000001: 1}: generating K1...K3 for KEYMAT. 2017-11-21 00:02:46.229 +0000 [DEBG]: {1000001: }: hmac(hmac_sha2_256) 2017-11-21 00:02:46.229 +0000 [DEBG]: {1000001: }: hmac(hmac_sha2_256) 2017-11-21 00:02:46.229 +0000 [DUMP]: 453db98a c7124fd1 91c627c2 ca66f436 c936a07b 3bb3a77b e082f1fa 08228332 7e10bc8d e99ef469 bfa96328 bb370e0b 97c203da e054ca84 c9148a60 d838f723 e7883c3c 79ffea97 43585e3c fcaac860 fac926cc f5bb7792 4073ce07 78a57d2b 2017-11-21 00:02:46.229 +0000 [DEBG]: {1000001: 1}: KEYMAT compute with 2017-11-21 00:02:46.229 +0000 [DUMP]: 03066f07 87f1f5ff 8a93f0d2 84188b4f 4edd15e6 1c0b4b7d 184c77ef b543fbb3 ef82c5ef b5 2017-11-21 00:02:46.229 +0000 [DEBG]: {1000001: }: hmac(hmac_sha2_256) 2017-11-21 00:02:46.229 +0000 [DEBG]: encryption(aes) 2017-11-21 00:02:46.229 +0000 [DEBG]: {1000001: 1}: encklen=256 authklen=160 2017-11-21 00:02:46.229 +0000 [DEBG]: {1000001: 1}: generating 768 bits of key (dupkeymat=3) 2017-11-21 00:02:46.229 +0000 [DEBG]: {1000001: 1}: generating K1...K3 for KEYMAT. 2017-11-21 00:02:46.229 +0000 [DEBG]: {1000001: }: hmac(hmac_sha2_256) 2017-11-21 00:02:46.229 +0000 [DEBG]: {1000001: }: hmac(hmac_sha2_256) 2017-11-21 00:02:46.229 +0000 [DUMP]: f7385777 d6854db1 939601f9 2f271288 5f64f0e2 b7fff356 f7eb62c4 79ab11b0 34ea816e ebbc13d8 209f4e1c 941c1e66 66d25ea8 2525017f 55eb4551 dd37ad40 df8c0902 8dcf8aa4 bce53a45 72e9de9a 35d71467 2afe0572 939c10be 22934ec6 2017-11-21 00:02:46.229 +0000 [DEBG]: { : 1}: KEYMAT computed. 2017-11-21 00:02:46.229 +0000 [PNTF]: { : 1}: ====> PHASE-2 NEGOTIATION SUCCEEDED AS RESPONDER, (QUICK MODE) <==== ====> Established SA: 10.10.24.1[500]-10.10.20.102[500] message id:0xCE87CE19, SPI:0xA884ECD1/0x066F0787 <==== 2017-11-21 00:02:46.231 +0000 [DEBG]: {1000001: 1}: call pk_sendupdate 2017-11-21 00:02:46.231 +0000 [DEBG]: encryption(aes) 2017-11-21 00:02:46.231 +0000 [INFO]: {1000001: 1}: pfkey update: ESP/Tunnel 10.10.20.102[500]->10.10.24.1[500] spi=2827283665(0xa884ecd1); client ip 10.10.30.124 2017-11-21 00:02:46.231 +0000 [INFO]: {1000001: 1}: SADB_UPDATE proto=255 10.10.20.102[500]=>10.10.24.1[500] ESP tunl spi 0xA884ECD1 auth=SHA1 enc=AES256/32 lifetime soft 3600/0 hard 3600/0 2017-11-21 00:02:46.231 +0000 [DUMP]: sadb_update: seq=2, ul_proto=255 sa_src=10.10.20.102[500]/0, sa_dst=10.10.24.1[500]/0, satype=141 (ESP), spi=0xA884ECD1, wsize=4, authtype=40 (SHA1), enctype=17 (AES256), saflags=0x0, samode=137 (tunl), reqid=0, lifetime hard time 3600, bytes 0, lifetime soft time 3600, bytes 0, enckey len=32 [453db98ac7124fd191c627c2ca66f436c936a07b3bb3a77be082f1fa08228332], authkey len=20 [7e10bc8de99ef469bfa96328bb370e0b97c203da] 2017-11-21 00:02:46.231 +0000 [DEBG]: {1000001: 1}: pfkey update sent. 2017-11-21 00:02:46.231 +0000 [DEBG]: encryption(aes) 2017-11-21 00:02:46.231 +0000 [INFO]: {1000001: 1}: SADB_ADD proto=255 10.10.24.1[500]=>10.10.20.102[500] ESP tunl spi 0x066F0787 auth=SHA1 enc=AES256/32 lifetime soft 2962/0 hard 3600/0       good tech note ..  https://live.paloaltonetworks.com/t5/Tech-Note-Articles/GlobalProtect-Configuration-for-the-IPsec-Client-on-Apple-iOS/tac-p/55937#M263     hope it helps,    Rob          hope this helps,    rob      ... View more

hi there,   seems ok on 8.0.6  🙂     admin@TAC-HomeLab> show user ip-user-mapping all type GP         IP               Vsys   From     User                             IdleTimeout(s) M axTimeout(s) --------------- ------ ------- -------------------------------- -------------- - ------------ 10.10.30.122     vsys1   GP       workphone                         2591957         2 591957       Total: 1 users   admin@TAC-HomeLab> show system info   hostname: TAC-HomeLab ip-address:  netmask:  default-gateway:  ip-assignment: static ipv6-address: unknown ipv6-link-local-address: unknown ipv6-default-gateway: mac-address:  time:  uptime:  family: 220 model: PA-220 serial: sw-version: 8.0.6 global-protect-client-package-version: 4.0.4 app-version: 750-4331 app-release-date: 2017/11/17   12:52:41 av-version: 2434-2928 av-release-date: 2017/11/18   04:03:33 threat-version: 750-4331 threat-release-date: 2017/11/17   12:52:41 lines 1-23   cheers   Rob  ... View more

Hi Mate,    Check the traffic logs ? is the traffic going down the tunnel when it should ? have ye set a static route for the traffic thats needed to go down the tunnel? Do you need nat traversal enabled? Don't need the proxy id's. few links below should help ye research further.  dynamic dds can help when you don't have a static address.    https://live.paloaltonetworks.com/t5/Featured-Articles/Tips-amp-Tricks-Why-Use-a-VPN-Proxy-ID/ta-p/69524   https://live.paloaltonetworks.com/t5/Management-Articles/IPSec-VPN-Tunnel-with-NAT-Traversal/ta-p/66188   https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-IPSec-VPN/ta-p/56535   https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Troubleshoot-IPSec-VPN-connectivity-issues/tac-p/59191#M985   https://live.paloaltonetworks.com/t5/Management-Articles/Advanced-VPN-IPSec-troubleshooting-8-0-enable-debugging-per-VPN/ta-p/169303   https://live.paloaltonetworks.com/t5/Management-Articles/The-IPSEC-Tunnel-Comes-Up-But-Hosts-Behind-Peer-Are-Not/ta-p/61110   cheers   Rob    ... View more

Hi Mate,    someone asked a similiar question below here; [check out the comments at the bottom] https://live.paloaltonetworks.com/t5/Featured-Articles/Getting-Started-Layer-3-Subinterfaces/ta-p/67395   generally can always test it one way or the other if not sure. best way to learn aswell.      cheers   rob  ... View more

Hi Hamza,    Short answer is yes you can. Does the different vlans have different zones ?  If they do just apply the src zone as required in your rules.  If they don't can seperate it using an address object range if the vlans have different subnets.  ref :  here's a link of a guy setting up a pa-200, using vlans and rules for the vlan https://live.paloaltonetworks.com/t5/Configuration-Articles/Setting-Up-the-PA-200-for-Home-and-Small-Office/ta-p/61838 here's a link for creating address range if no seperate zones for the vlans https://www.paloaltonetworks.com/documentation/71/pan-os/web-interface-help/objects/objects-addresses     cheers    Rob  ... View more

Hi Mate,    On the latest mac {10.12.6} and gp {4.0.4.9}connecting fine. Connecting with a local user saved on the pan. Connecting to a loopback interface. Can connect when local or remote. Using a fqdn all gp prerequisites adherred to.    as a few things to check;   if using an fqdn to connect, ping it from the mac terminal. does it resolve to the right ip ? do ye see the pings on the traffic logs of the firewall? if using internal / external networks can connect ? hotspot off phone and try connect etc when ye filter using '( app eq panos-global-protect )' in the traffic logs do ye see the attempted connection? when ye filter in the system logs '( subtype eq globalprotect )' do ye see anything for the mac book attempted connection? allow the gp portal temp if not enabled, can the mac get to the portal web page and authenticate when using a browser ? are you using the hip feature to only allow certain devices? check the hip logs, monitor>hip have you tried off a different mac book? if not can ye ? if windows connecting ok narrows it down a bit, if another mac can would narrow it down a lot 🙂     theres a successful connection for a mac on yer mac version below, sanistised anything important, ips/fqdns/hostnames I am an admin on the mac, its not part of a domain..   cheers   rob    gps logs    P 472-T16387 Nov 02 23:06:36:2365 Debug( 89): Check hip command line: /Applications/GlobalProtect.app/Contents/Resources/PanGpHip 4.0.4-9 "Apple Mac OS X 10.12.6" 5 10:dd:b1:cc:54:c0 P 472-T13063 Nov 02 23:06:36:2396 Debug(1417): Serialized portal user auth cookie to file /Users/random/Library/Application Support/PaloAltoNetworks/GlobalProtect/PanPUAC_8942d69f99597cbaeb0e0a116228731.dat. 368 bytes. P 472-T13063 Nov 02 23:06:36:2409 Debug(1253): Serialize non-empty cookie for portal gp.com and pre-logon user P 472-T32283 Nov 02 23:06:36:2778 Debug( 185): CheckHipMissingPatchInOtherProcess(): Launched PanGpHipMp P 472-T16387 Nov 02 23:06:36:3077 Debug( 103): CheckHipInOtherProcess(): Launched PanGpHip P 472-T13063 Nov 02 23:06:36:3259 Debug(1260): SerializePortalPrelogonAuthCookie to file PanPPAC_c6ad5db18352493f28d87810fcfb25c2.dat P 472-T13063 Nov 02 23:06:36:3271 Debug(6053): Retrieved pre-logon-tunnel-rename-timeout value -1 P 472-T13063 Nov 02 23:06:36:3276 Debug(6061): Retrieved user-switch-tunnel-rename-timeout value 0 P 472-T13063 Nov 02 23:06:36:3281 Debug(6077): The value of can-continue-if-portal-cert-invalid is yes P 472-T13063 Nov 02 23:06:36:3285 Debug(5249): prelogon status is 0 P 472-T13063 Nov 02 23:06:36:3290 Debug(5373): Force discovery, set NetworkDiscoverEvent P 472-T13063 Nov 02 23:06:36:5700 Debug(1038): Send response to client for request hip P 472-T13335 Nov 02 23:06:36:5889 Debug( 451): Set hip report quit event P 472-T13335 Nov 02 23:06:36:5899 Debug(3591): NetworkDiscoverThread: got network discover event. P 472-T13335 Nov 02 23:06:36:5904 Debug(3598): ----Network Discover starts---- P 472-T13335 Nov 02 23:06:36:5908 Debug( 759): SetNextScheduledHipCheckTime to 0 P 472-T13335 Nov 02 23:06:36:5912 Debug( 781): m_bScheduleFlag is set to 0 P 472-T13335 Nov 02 23:06:36:5919 Debug(4677): --Set state to Discovering network... P 472-T13335 Nov 02 23:06:36:25413 Debug( 254): There is no ipv6 interface P 472-T13335 Nov 02 23:06:36:25551 Debug( 254): There is no ipv6 interface P 472-T13335 Nov 02 23:06:36:25604 Debug( 203): interface en1 ip 1.1.1.1/255.255.255.0 P 472-T13335 Nov 02 23:06:36:25735 Debug( 254): There is no ipv6 interface P 472-T13335 Nov 02 23:06:36:25832 Debug( 254): There is no ipv6 interface P 472-T13335 Nov 02 23:06:36:25928 Debug( 254): There is no ipv6 interface P 472-T13335 Nov 02 23:06:36:26184 Debug( 714): Hip report changed. Include it in status message to client. P 472-T13335 Nov 02 23:06:36:29363 Info (1071): <SCNetworkReachability 0x7fc7fdd60cc0 [0x7fffe0f9cda0]> {name = gp.com} is reachable 2 P 472-T13335 Nov 02 23:06:36:29385 Debug(3604): finish check host reachable P 472-T13335 Nov 02 23:06:36:29407 Debug(4677): --Set state to Discovering network... P 472-T13335 Nov 02 23:06:36:30858 Debug(3637): Logout gateways before network discover... P 472-T13335 Nov 02 23:06:36:30872 Debug(1112): Logging out gateway, reason is Network discover P 472-T13335 Nov 02 23:06:36:30877 Debug(1142): Logging out gateway over P 472-T13335 Nov 02 23:06:36:30982 Debug(9243): RetrieveClientIpByRemoteHost() - invalid remote host: . P 472-T13335 Nov 02 23:06:36:30992 Debug( 178): SelectInternalGateways - failed to retrieve client source ipv6! P 472-T13335 Nov 02 23:06:36:31007 Debug( 231): found matching ipv4 ipaddress (10.10.20.1-10.10.20.254) in the list for gateway () P 472-T13335 Nov 02 23:06:36:31013 Debug( 330): Found match of client ip in the source ip list! P 472-T13335 Nov 02 23:06:36:31020 Debug(4297): Process gateway: host internal.pan1, description tac P 472-T16139 Nov 02 23:06:36:31111 Debug(3421): CaptivePortalDetectionThread: IsDetectingCaptivePortal=1, PreLoginIsDone=0 P 472-T16139 Nov 02 23:06:36:31121 Debug(3399): CaptivePortalDetectionThread: wait (2000 ms) for captive portal detection event. P 472-T13335 Nov 02 23:06:36:776365 Debug(4297): Process gateway: host gp.com, description extenralgw P 472-T13335 Nov 02 23:06:36:777682 Debug(4380): Gateway gp.com ipv4 address is 10.10.24.1 P 472-T13335 Nov 02 23:06:36:777696 Debug(4483): Gateway gp.com: ipv4 10.10.24.1, ipv6 , FQDN yes P 472-T13335 Nov 02 23:06:36:777708 Debug(3656): Set network discover in progress P 472-T13335 Nov 02 23:06:36:777713 Debug(3712): NetworkDiscoverThread: network type is external. P 472-T13335 Nov 02 23:06:36:777718 Debug(3781): NetworkDiscoverThread: Discover external network. P 472-T13335 Nov 02 23:06:36:777723 Debug( 494): Discover external gateway: gateway count is 1, cutoff time is 5 P 472-T13335 Nov 02 23:06:36:777785 Debug(2365): Gateway: gp.com, client IP: 1.1.1.1 P 472-T13335 Nov 02 23:06:36:880056 Debug(2067): retrieve info of gateway gp.com P 472-T13335 Nov 02 23:06:36:880073 Debug(2078): Skip setting proxy for creating tunnel to gateway gp.com P 472-T13335 Nov 02 23:06:36:880081 Debug(2788): ----Gateway Pre-login starts---- P 472-T13335 Nov 02 23:06:36:880312 Debug(5161): connect ssl. P 472-T13335 Nov 02 23:06:36:880320 Debug( 693): SSL connecting to 10.10.24.1 P 472-T13335 Nov 02 23:06:36:906148 Debug(5211): Internal gateway gp.com is authenticated with trusted CA. P 472-T13335 Nov 02 23:06:36:906168 Debug( 909): Cert name check of gp.com succeeded P 472-T13335 Nov 02 23:06:36:906173 Debug(5232): Server cert is verified for gateway gp.com P 472-T13335 Nov 02 23:06:36:906176 Debug(5234): disconnect ssl. P 472-T13335 Nov 02 23:06:36:906215 Debug(1202): SSL3 alert write:warning:close notify P 472-T13335 Nov 02 23:06:36:906372 Debug(2810): Server cert is verified for gateway gp.com P 472-T13335 Nov 02 23:06:36:907115 Debug( 176): Original host gp.com(gp.com):443 P 472-T13335 Nov 02 23:06:36:907129 Debug(7740): Need to check gateway cert for gp.com P 472-T13335 Nov 02 23:06:36:907142 Info ( 199): EVP_DecryptFinal_ex failed P 472-T13335 Nov 02 23:06:36:907146 Info ( 635): pan_get_password failed. P 472-T13335 Nov 02 23:06:36:907149 Info ( 256): Failed to retrieve passphrase route: writing to routing socket: not in table P 472-T13335 Nov 02 23:06:36:980220 Debug( 308): Response has no private header. P 472-T13335 Nov 02 23:06:36:980249 Debug( 335): receive data with length 343 P 472-T13335 Nov 02 23:06:36:980322 Debug(2871): Login to gateway (null) gp.com without ipv6 P 472-T13335 Nov 02 23:06:36:980332 Debug(7772): StopCaptivePortalDetection() captive portal detection is in progress P 472-T16139 Nov 02 23:06:36:980354 Debug(3421): CaptivePortalDetectionThread: IsDetectingCaptivePortal=0, PreLoginIsDone=1 P 472-T16139 Nov 02 23:06:36:980364 Debug(3399): CaptivePortalDetectionThread: wait (-1 ms) for captive portal detection event. P 472-T13335 Nov 02 23:06:36:980752 Debug(2899): Pre-login response is <?xml version="1.0" encoding="UTF-8" ?> <prelogin-response> <status>Success</status> <ccusername></ccusername> <autosubmit>false</autosubmit> <msg></msg> <license>yes</license> <authentication-message>Enter login credentials</authentication-message> <panos-version>1</panos-version><region>10.0.0.0-10.255.255.255</region> </prelogin-response> P 472-T13335 Nov 02 23:06:36:980772 Debug(2904): REGION-PRIO, gateway region code is 10.0.0.0-10.255.255.255 P 472-T13335 Nov 02 23:06:36:980776 Debug(2921): REGION-PRIO, portal and gateway have same region code! P 472-T13335 Nov 02 23:06:36:980782 Debug(2998): Auth message is Enter login credentials for gateway gp.com P 472-T13335 Nov 02 23:06:36:980786 Debug(3021): Gateway license yes, license-v6 yes P 472-T13335 Nov 02 23:06:36:980798 Debug(3096): ----Gateway Login starts---- P 472-T13335 Nov 02 23:06:36:980801 Debug(7873): Set to service bUseCCUserGateway 0 and ccUserNameGateway P 472-T13335 Nov 02 23:06:36:980805 Debug(1755): Update user name from to test P 472-T13335 Nov 02 23:06:36:980809 Debug(4990): OtpSaveCredential is save_credential P 472-T13335 Nov 02 23:06:36:980811 Debug(5028): External network gateway without OTP authentication P 472-T13335 Nov 02 23:06:36:980814 Debug(5049): Can save user and password. Use saved user credential P 472-T13335 Nov 02 23:06:36:980954 Debug(1356): Unserialized non-empty cookie for portal gp.com and user test P 472-T13335 Nov 02 23:06:36:981006 Debug(1285): Unserialized non-empty cookie for portal gp.com and pre-logon user. P 472-T13335 Nov 02 23:06:36:981011 Debug(3145): Auth cookie is not empty for user test. Reset bDPGC flag. P 472-T13335 Nov 02 23:06:36:981014 Debug(3149): bIsEmptyUser is 0, bDPGCforManualOnlyGateway is 0, bDPGCNotforManualOnlyGateway is 0 P 472-T13335 Nov 02 23:06:36:981017 Debug(7873): Set to service bUseCCUserGateway 0 and ccUserNameGateway P 472-T13335 Nov 02 23:06:36:981050 Debug(1356): Unserialized non-empty cookie for portal gp.com and user test P 472-T13335 Nov 02 23:06:36:981085 Debug(1285): Unserialized non-empty cookie for portal gp.com and pre-logon user. P 472-T13335 Nov 02 23:06:36:981089 Debug(3226): Actual user for gateway login is test P 472-T13335 Nov 02 23:06:36:981491 Debug(4792): Get preferred IPv4 10.10.30.104 for gateway 10.10.24.1 and user test P 472-T13335 Nov 02 23:06:36:981766 Debug(4820): Get preferred IPv6 for gateway 10.10.24.1 and user test P 472-T13335 Nov 02 23:06:36:982214 Debug( 176): Original host gp.com(gp.com):443 P 472-T13335 Nov 02 23:06:36:982233 Info ( 199): EVP_DecryptFinal_ex failed P 472-T13335 Nov 02 23:06:36:982237 Info ( 635): pan_get_password failed. P 472-T13335 Nov 02 23:06:36:982240 Info ( 256): Failed to retrieve passphrase P 472-T13335 Nov 02 23:06:37:156639 Debug( 308): Response has no private header. P 472-T13335 Nov 02 23:06:37:156662 Debug( 335): receive data with length 1319 P 472-T13335 Nov 02 23:06:37:157237 Debug(1370): Serialize non-empty cookie for portal gp.com and user test P 472-T13335 Nov 02 23:06:37:157499 Debug(1417): Serialized portal user auth cookie to file /Users/random/Library/Application Support/PaloAltoNetworks/GlobalProtect/PanPUAC_8942d69f99597cbaeb0e0a116228731.dat. 368 bytes. P 472-T13335 Nov 02 23:06:37:157513 Debug(1253): Serialize non-empty cookie for portal gp.com and pre-logon user P 472-T13335 Nov 02 23:06:37:157660 Debug(1260): SerializePortalPrelogonAuthCookie to file PanPPAC_c6ad5db18352493f28d87810fcfb25c2.dat P 472-T13335 Nov 02 23:06:37:157702 Debug(7859): NetworkDisoverEventSet is no, RedoNetworkDiscovery is no P 472-T13335 Nov 02 23:06:37:157706 Debug(2088): ----Tunnel creation starts---- P 472-T13335 Nov 02 23:06:37:157709 Debug(2089): Try to create tunnel with gateway gp.com P 472-T13335 Nov 02 23:06:37:157714 Debug(4677): --Set state to Connecting... P 472-T13335 Nov 02 23:06:37:159052 Debug(1965): proxy , proxyuser , domain , user test, remotehost 10.10.24.1. P 472-T13335 Nov 02 23:06:37:159162 Debug( 140): interface en1 ip 1.1.1.1/255.255.255.0 P 472-T13335 Nov 02 23:06:37:159178 Debug( 147): found 1 ips P 472-T13335 Nov 02 23:06:37:159337 Debug( 67): interface en1 ip6 fe80::1c4d:52e5:259a:e908/64 P 472-T13335 Nov 02 23:06:37:159353 Debug( 67): interface awdl0 ip6 fe80::848:97ff:fedd:1384/64 P 472-T13335 Nov 02 23:06:37:159362 Debug( 67): interface utun0 ip6 fe80::aa1b:c431:4eef:6c3b/64 P 472-T13335 Nov 02 23:06:37:159369 Debug( 74): found 3 ip6s P 472-T13335 Nov 02 23:06:37:159556 Debug(2217): Get gateway config. P 472-T13335 Nov 02 23:06:37:160276 Debug( 176): Original host gp.com(gp.com):443 P 472-T13335 Nov 02 23:06:37:160301 Info ( 199): EVP_DecryptFinal_ex failed P 472-T13335 Nov 02 23:06:37:160310 Info ( 635): pan_get_password failed. P 472-T13335 Nov 02 23:06:37:160315 Info ( 256): Failed to retrieve passphrase P 472-T13335 Nov 02 23:06:37:200888 Debug( 308): Response has no private header. P 472-T13335 Nov 02 23:06:37:200918 Debug( 335): receive data with length 1489 P 472-T13335 Nov 02 23:06:37:201005 Debug(2243): gateway gp.com's config is <response status="success"> <need-tunnel>yes</need-tunnel> <ssl-tunnel-url>/ssl-tunnel-connect.sslvpn</ssl-tunnel-url> <portal>gwGP-N</portal> <user test</user> <lifetime>2592000</lifetime> <timeout>10800</timeout> <disconnect-on-idle>10800</disconnect-on-idle> <bw-c2s>1000</bw-c2s> <bw-s2c>1000</bw-s2c> <gw-address>10.10.24.1</gw-address> <ip-address>10.10.30.104</ip-address> <netmask>255.255.255.255</netmask> <dns> <member>10.10.30.1</member> </dns> <wins> </wins> <dns-suffix> </dns-suffix> <default-gateway>10.10.30.104</default-gateway> <mtu>0</mtu> <no-direct-access-to-local-network>no</no-direct-access-to-local-network> <access-routes> <member>0.0.0.0/0</member> <member>10.10.30.1/32</member> </access-routes> <exclude-access-routes> </exclude-access-routes> <ipsec> <udp-port>4501</udp-port> <ipsec-mode>esp-tunnel</ipsec-mode> <enc-algo>aes-128-cbc</enc-algo> <hmac-algo>sha1</hmac-algo> P 472-T13335 Nov 02 23:06:37:201709 Debug( 257): gw-address-v6 is not specified P 472-T13335 Nov 02 23:06:37:201723 Debug( 263): remoteHostV6 is not specified P 472-T13335 Nov 02 23:06:37:202150 Debug(7552): Set preferred IP 10.10.30.104 for gateway 10.10.24.1 user test P 472-T13335 Nov 02 23:06:37:206330 Debug( 385): DLSA, found no-direct-access-to-local-network tag, b_IsDLSASet set to false P 472-T13335 Nov 02 23:06:37:206389 Debug( 572): Encryption method is aes-128-cbc P 472-T13335 Nov 02 23:06:37:206490 Debug(2876): set driver connected as true P 472-T15879 Nov 02 23:06:37:206605 Debug(1383): Route change message RTM_IFINFO: iface status change, gpd0 up P 472-T13335 Nov 02 23:06:37:206649 Debug( 123): disconnect-on-idle timeout is 10800 P 472-T13335 Nov 02 23:06:37:206657 Debug( 133): VPN idle timeout is 10800; config timeout is 10800 P 472-T22287 Nov 02 23:06:37:206671 Debug(4246): NetworkConnectionMonitorThread: route change detected. Wait for 3 seconds. P 472-T13335 Nov 02 23:06:37:206717 Debug( 146): STATIC IP, use dhcp to assign ip P 472-T13335 Nov 02 23:06:37:206759 Debug( 162): Trying to do ipsec connection to 10.10.24.1[4501] P 472-T13335 Nov 02 23:06:37:207098 Info ( 174): Connected to: 10.10.24.1[4501], Sending keep alive to ipsec socket... P 472-T13335 Nov 02 23:06:37:221808 Info ( 212): Connected ipsec to 10.10.24.1(4501) P 472-T13335 Nov 02 23:06:37:221861 Info ( 299): tunnel to 10.10.24.1 connected P 472-T13335 Nov 02 23:06:37:221931 Debug( 318): PsvRegister done P 472-T41483 Nov 02 23:06:37:221986 Debug( 364): VpnProcMonitor thread starts P 472-T13335 Nov 02 23:06:37:222008 Debug( 753): Installing client config... P 472-T41735 Nov 02 23:06:37:222054 Debug( 375): VpnProcDrv thread starts P 472-T775 Nov 02 23:06:37:232779 Debug( 312): receive sig 20 P 472-T13335 Nov 02 23:06:37:232809 Debug( 119): route script dir /Library/Logs/PaloAltoNetworks/GlobalProtect//network/config P 472-T13335 Nov 02 23:06:37:233334 Debug( 201): generated interface script install: /Library/Logs/PaloAltoNetworks/GlobalProtect//network/config/itf-install.sh, uninstall: /Library/Logs/PaloAltoNetworks/GlobalProtect//network/config/itf-uninstall.sh P 472-T13335 Nov 02 23:06:37:233987 Debug( 520): original dns is set { ServerAddresses = ( "10.10.20.1", "8.8.8.8" ); } P 472-T13335 Nov 02 23:06:37:234085 Debug( 528): tunnel dns is { SearchDomains = ( ); SearchOrder = 50000; ServerAddresses = ( "10.10.30.1" ); } P 472-T13335 Nov 02 23:06:37:234363 Debug( 40): SCDynamicStoreCopyValue(State:/Network/Global/IPv6) failed: No such key P 472-T13335 Nov 02 23:06:37:234372 Error( 436): pan_SC_GetPropertyList(State:/Network/Global/IPv6) failed P 472-T13335 Nov 02 23:06:37:234378 Info ( 589): failed to get PrimaryService for IPv6 P 472-T13335 Nov 02 23:06:37:234570 Debug( 493): generated route script install: /Library/Logs/PaloAltoNetworks/GlobalProtect//network/config/rt-install.sh, uninstall: /Library/Logs/PaloAltoNetworks/GlobalProtect//network/config/rt-uninstall.sh P 472-T13335 Nov 02 23:06:37:234589 Debug(1139): Generate remote host access route to ipv4 gateway: 10.10.24.1 P 472-T775 Nov 02 23:06:37:242076 Debug( 312): receive sig 20 P 472-T775 Nov 02 23:06:37:247519 Debug( 312): receive sig 20 P 472-T13335 Nov 02 23:06:37:247545 Debug( 264): Default gateway: 10.10.20.1 P 472-T775 Nov 02 23:06:37:255579 Debug( 312): receive sig 20 P 472-T13335 Nov 02 23:06:37:255609 Debug(1066): add default route P 472-T775 Nov 02 23:06:37:260421 Debug( 312): receive sig 20 P 472-T775 Nov 02 23:06:37:265562 Debug( 312): receive sig 20 P 472-T13335 Nov 02 23:06:37:265598 Info ( 330): failed to find default gateway P 472-T13335 Nov 02 23:06:37:265607 Error( 385): failed to find default route v6 P 472-T775 Nov 02 23:06:37:274302 Debug( 312): receive sig 20 P 472-T13335 Nov 02 23:06:37:274732 Debug( 203): interface en1 ip 1.1.1.1/255.255.255.0 P 472-T13335 Nov 02 23:06:37:274742 Debug( 794): phsical interface ip 1.1.1.1 P 472-T13335 Nov 02 23:06:37:274768 Debug( 865): Installing interface ... P 472-T15879 Nov 02 23:06:37:286202 Debug(1374): Route change message RTM_NEWADDR: address being added to iface gpd0: 10.10.30.104 P 472-T13335 Nov 02 23:06:37:286999 Debug( 203): interface gpd0 ip 10.10.30.104/255.255.255.255 P 472-T13335 Nov 02 23:06:37:287021 Debug(1046): tunnel interface got ip 10.10.30.104 P 472-T13335 Nov 02 23:06:37:290721 Debug( 87): SCDynamicStoreSetValue(State:/Network/Service/gpd.pan/DNS) succeeded P 472-T13335 Nov 02 23:06:37:294066 Debug( 87): SCDynamicStoreSetValue(State:/Network/Service/gpd.pan/IPv4) succeeded P 472-T13335 Nov 02 23:06:37:303684 Debug( 87): SCDynamicStoreSetValue(State:/Network/Service/gpd.pan/IPv6) succeeded P 472-T13335 Nov 02 23:06:37:303811 Debug( 905): Installing routes... P 472-T13335 Nov 02 23:06:37:339267 Debug(3452): Found specific route to gateway 10.10.24.1. P 472-T13335 Nov 02 23:06:37:339305 Debug(2250): DLSA: addrtforsave P 472-T13335 Nov 02 23:06:37:339476 Debug(3401): DLSA: lif count is 1 P 472-T13335 Nov 02 23:06:37:339501 Debug(2278): DLSA: saveroutes to file P 472-T13335 Nov 02 23:06:37:339506 Debug(2287): size of lar_file_header_t is 608 P 472-T13335 Nov 02 23:06:37:339511 Debug(2301): m_rts2save[0]->rtm_msglen is 124 P 472-T13335 Nov 02 23:06:37:339808 Debug( 102): pan_write_to_file(): wrote 736 of 736 bytes to file /Library/Application Support/PaloAltoNetworks/GlobalProtect/pan_lar.dat. P 472-T13335 Nov 02 23:06:37:339821 Debug(2314): DLSA: 1/1 local access routes saved. Size 732 P 472-T13335 Nov 02 23:06:37:339826 Debug(3456): Gateway specific route is saved P 472-T13335 Nov 02 23:06:37:339831 Debug( 321): Setting exclude routes... P 472-T13335 Nov 02 23:06:37:339834 Debug( 334): Save route table snapshot... P 472-T13335 Nov 02 23:06:37:339847 Debug( 423): ipsec connect(10.10.24.1) succeed P 472-T13335 Nov 02 23:06:37:339854 Debug(7520): VPN tunnel is connected. P 472-T13335 Nov 02 23:06:37:339858 Debug(7524): Enable life time and create life time thread. P 472-T13335 Nov 02 23:06:37:339896 Debug(4677): --Set state to Connected P 472-T13335 Nov 02 23:06:37:341514 Debug(7680): SetVpnStatus called with new status=1, Previous Status=0 P 472-T42007 Nov 02 23:06:37:343192 Debug(2811): LifeTimeThread starts P 472-T13335 Nov 02 23:06:37:449605 Debug(2102): Tunnel is created with the gateway gp.com P 472-T13335 Nov 02 23:06:37:449635 Debug(2124): tunnel to gp.com is created. P 472-T13335 Nov 02 23:06:37:449641 Debug(3803): NetworkDiscoverThread: SetEvent network discover ready event for external network discovery. P 472-T13335 Nov 02 23:06:37:449646 Debug( 452): Reset hip report quit event P 472-T17675 Nov 02 23:06:37:449696 Debug(4028): HipReportThread: got network discover ready event. P 472-T13335 Nov 02 23:06:37:449708 Debug( 487): pan_read_text_from_file(): File does not exist. File: /Users/random/Library/Application Support/PaloAltoNetworks/GlobalProtect/dalog.dat P 472-T13335 Nov 02 23:06:37:449733 Debug(7680): SetVpnStatus called with new status=1, Previous Status=1 P 472-T13335 Nov 02 23:06:37:449746 Debug(3855): NetworkDiscoverThread: PortalStatus is 1, HasLoggedOnGateway is 1 P 472-T13335 Nov 02 23:06:37:449755 Debug(3931): Reset NetworkDiscovery waitTime to 5 seconds. P 472-T13335 Nov 02 23:06:37:449760 Debug(3576): NetworkDiscoverThread: wait for network discover event. P 472-T22287 Nov 02 23:06:37:449841 Debug( 203): interface en1 ip 1.1.1.1/255.255.255.0 P 472-T17675 Nov 02 23:06:37:455645 Debug( 254): There is no ipv6 interface P 472-T17675 Nov 02 23:06:37:455738 Debug( 254): There is no ipv6 interface P 472-T17675 Nov 02 23:06:37:455781 Debug( 203): interface en1 ip 1.1.1.1/255.255.255.0 P 472-T17675 Nov 02 23:06:37:455889 Debug( 254): There is no ipv6 interface P 472-T17675 Nov 02 23:06:37:455962 Debug( 254): There is no ipv6 interface P 472-T17675 Nov 02 23:06:37:456033 Debug( 254): There is no ipv6 interface P 472-T775 Nov 02 23:06:37:456316 Debug( 312): receive sig 20 P 472-T17675 Nov 02 23:06:37:456678 Debug(4059): Sending hip report delay max registry setting is -1 seconds P 472-T17675 Nov 02 23:06:37:456686 Debug(4061): Set max sending hip report delay to default 1800 seconds P 472-T17675 Nov 02 23:06:37:456729 Debug(4076): hip report is encoded P 472-T17675 Nov 02 23:06:37:456754 Debug(4098): HIP report md5 digest is 597b3971c9e9d7622a5fdfb4b846ef2 P 472-T17675 Nov 02 23:06:37:456765 Debug(4125): HipReportThread: network type is external network. P 472-T17675 Nov 02 23:06:37:456819 Debug(3843): Entering SendHipReportToGateway(). Gateway: gp.com P 472-T17675 Nov 02 23:06:37:456825 Debug( 771): m_bScheduleFlag is 0 P 472-T17675 Nov 02 23:06:37:456829 Debug( 781): m_bScheduleFlag is set to 1 P 472-T17675 Nov 02 23:06:37:456833 Debug(3867): Gateway gp.com: now is 1509663997, next hip checking is 0, next hip report check sending time is 0, last hip report check sending time is 0, sending hip delay is 0 ms P 472-T17675 Nov 02 23:06:37:456838 Debug(3884): Wait for 0 ms to send hip report check to gateway gp.com P 472-T17675 Nov 02 23:06:37:456846 Debug(3897): Time to send hip report to gateway gp.com P 472-T17675 Nov 02 23:06:37:456914 Debug(2365): Gateway: gp.com, client IP: 1.1.1.1 P 472-T17675 Nov 02 23:06:37:456949 Debug(3914): Hip report head to gateway gp.com is <?xml version="1.0" encoding="UTF-8"?> <hip-report> <md5-sum>597b3971c9e9d7622a5fdfb4b846ef2</md5-sum> <user-name test</user-name> <domain></domain> <host-name>test</host-name> <host-id>10:dd:b1:cc:54:c0</host-id> <ip-address>10.10.30.104</ip-address> <ipv6-address></ipv6-addres P 472-T17675 Nov 02 23:06:37:456955 Debug(4053): SendHipReportNReceive() P 472-T17675 Nov 02 23:06:37:456977 Debug(4075): bUseCCUser=0, ccUserName=, m_userName test P 472-T17675 Nov 02 23:06:37:456982 Debug(4078): using https to send hip report check to gateway gp.com P 472-T17675 Nov 02 23:06:37:456989 Debug(4114): Network discover SN 14 remains same. P 472-T17675 Nov 02 23:06:37:457125 Debug( 693): SSL connecting to 10.10.24.1 P 472-T17675 Nov 02 23:06:37:496758 Debug(1202): SSL3 alert write:warning:close notify P 472-T17675 Nov 02 23:06:37:496874 Debug(4127): Gateway gp.com, response to the hip report check: <response status="success"> <hip-report-needed>yes</hip-report-needed> <delay>0</delay> </response> P 472-T17675 Nov 02 23:06:37:496883 Info (4129): sent HIP report check to gp.com. P 472-T17675 Nov 02 23:06:37:497310 Debug(4157): Response status of HIP report check is success, gateway gp.com P 472-T17675 Nov 02 23:06:37:497328 Debug(4159): Hip report check returns success. P 472-T17675 Nov 02 23:06:37:497336 Debug(3928): SendHipReportNReceive returns TRUE for gateway gp.com P 472-T17675 Nov 02 23:06:37:497343 Debug(3942): Hip notification is empty in the HIP report check response from gateway gp.com P 472-T17675 Nov 02 23:06:37:497367 Info (3952): Hip report is needed for gateway gp.com. P 472-T17675 Nov 02 23:06:37:497379 Info (3965): Send hip report to gateway gp.com. P 472-T17675 Nov 02 23:06:37:497400 Debug(4053): SendHipReportNReceive() P 472-T17675 Nov 02 23:06:37:497409 Debug(4075): bUseCCUser=0, ccUserName=, m_userName test P 472-T17675 Nov 02 23:06:37:497415 Debug(4078): using https to send hip report to gateway gp.com P 472-T17675 Nov 02 23:06:37:497428 Debug(4114): Network discover SN 14 remains same. P 472-T17675 Nov 02 23:06:37:497551 Debug( 693): SSL connecting to 10.10.24.1 P 472-T17675 Nov 02 23:06:37:555125 Debug(1202): SSL3 alert write:warning:close notify P 472-T17675 Nov 02 23:06:37:555244 Debug(4127): Gateway gp.com, response to the hip report : <response status="success"> <notification><hip-notification/></notification> </response> P 472-T17675 Nov 02 23:06:37:555253 Info (4129): sent HIP report to gp.com. P 472-T17675 Nov 02 23:06:37:555745 Debug(4157): Response status of HIP report is success, gateway gp.com P 472-T17675 Nov 02 23:06:37:555761 Debug(4159): Hip report returns success. P 472-T17675 Nov 02 23:06:37:555767 Info (3968): Got hip notification from gateway gp.com. P 472-T17675 Nov 02 23:06:37:555772 Debug(3970): Hip notification is not empty in the HIP report response from gateway gp.com. Update hip notification for the gateway. P 472-T17675 Nov 02 23:06:37:555776 Debug(3984): SSL is disconnected. Returns TRUE. P 472-T17675 Nov 02 23:06:37:555892 Debug(1338): SendHipReportToGateway gp.com returns TRUE. P 472-T17675 Nov 02 23:06:37:557981 Debug(4002): HipReportThread: wait for HIP report ready event. P 472-T22287 Nov 02 23:06:40:645086 Debug(4306): NetworkConnectionMonitorThread: m_state = 0, m_bOnDemand=1, m_bAgentEnabled=1, m_bJustResumed is 0, m_bHibernate is 0, m_bAgentEnabled is 1, m_bDisconnect is 0, IsConnected() is 1, IsVPNInRetry() is 0. P 472-T22287 Nov 02 23:06:40:645174 Debug( 203): interface en1 ip 1.1.1.1/255.255.255.0 P 472-T22287 Nov 02 23:06:40:651241 Debug(4322): NetworkConnectionMonitorThread: Detected route change, but skip network discovery. P 472-T22287 Nov 02 23:06:40:651262 Debug(4246): NetworkConnectionMonitorThread: route change detected. Wait for 3 seconds. P 472-T775 Nov 02 23:06:40:651277 Debug( 312): receive sig 20 P 472-T22287 Nov 02 23:06:40:651322 Debug( 203): interface en1 ip 1.1.1.1/255.255.255.0 P 472-T775 Nov 02 23:06:40:657005 Debug( 312): receive sig 20 P 472-T22287 Nov 02 23:06:43:731002 Debug(4306): NetworkConnectionMonitorThread: m_state = 0, m_bOnDemand=1, m_bAgentEnabled=1, m_bJustResumed is 0, m_bHibernate is 0, m_bAgentEnabled is 1, m_bDisconnect is 0, IsConnected() is 1, IsVPNInRetry() is 0. P 472-T22287 Nov 02 23:06:43:731083 Debug( 203): interface en1 ip 1.1.1.1/255.255.255.0 P 472-T22287 Nov 02 23:06:43:736043 Debug(4322): NetworkConnectionMonitorThread: Detected route change, but skip network discovery. P 472-T775 Nov 02 23:06:43:736068 Debug( 312): receive sig 20     ... View more

Hi There,   It would work for a few minutes until the first 200 sessions expire. Wouldn't reccommend it if a production enviroment. If you want a trial of a licenced VM for 30 days, you can request same from your local PAN SE, distributor or reseller.  vpn's - would work until first 200 sessions expire Global protect - depends what version, if using 4.0.x client, won't need a licence if connecting windows/macbooks, ye will if connecting androids/iphones using the client. X-auth on these devcies won't need a licence. again, will cut out after 200 sessions.    // An unlicensed VM-Series firewall can pass up to the first 200 sessions, after that it will block the session. The firewall allows only the first 200 sessions. //   cheers,   Rob  ... View more

Hi there,    Nice article below on file blocking.    https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/threat-prevention/set-up-file-blocking https://live.paloaltonetworks.com/t5/Configuration-Articles/FileType-list-with-the-Threat-ID-number/ta-p/56119   Explains the basics if using PAN-OS 8.0.x.      Cheers,    Rob  ... View more

Hi Guys,    We observed this for some users. Seems to be a recurrance of a previous bug.    Double check the auth type is 'Any' not 'any' for the portal config.    If using loopbacks for the portal can be an issue at previously , tested on 8.0.5 on pa-220 just now and connects fine with a loopback.      in the config double check the auth type has capital 'A'.    <global-protect-portal> <entry name="external"> <portal-config> <local-address> <ip> <ipv4>10.10.24.1</ipv4> </ip> <interface>loopback.1</interface> </local-address> <client-auth> <entry name="local"> <os>Any</os> <authentication-profile>local</authentication-profile> <authentication-message>Enter login credentials</authentication-message> </entry> </client-auth> <ssl-tls-service-profile>brookfieldlab</ssl-tls-service-profile> </portal-config> <client-config> <configs> <entry name="configGP"> <gateways> <external> <list>   added edit ;    double check the gateway config has a capital A as well.. 🙂     > configure # set global-protect global-protect-gateway <gateway_name> client-auth <client_auth_name> os Any  # commit      best regards,    Rob  ... View more

Hi Mate,    Would look at upgrading the Panorama as its unsupported anyway..    The articles below always useful for looking at this error.    https://live.paloaltonetworks.com/t5/Management-Articles/Managed-Devices-Unable-to-Establish-Connections-to-Panorama/ta-p/53248 https://live.paloaltonetworks.com/t5/Management-Articles/Device-Showing-as-Disconnected-on-the-Panorama/ta-p/76666 https://live.paloaltonetworks.com/t5/Management-Articles/Troubleshooting-Panorama-Connectivity/ta-p/54224     ref :  https://www.paloaltonetworks.com/services/support/end-of-life-announcements/end-of-life-summary   best regards,    Rob  ... View more