About Radmin_85

Radmin_85 · ‎01-31-2019

hello all after upgrade to new GP 4.1.8 there is some kind of problem The phones try to connect to portal and gateway and after it we get security warning but we continue and get connected But then when we try to connect ones more the GP says it is failed. We must re-enter the login and password again Is it some way to stay connected on GP even if you close the GP application on phone? And how i can install the exported self-signed certificate from PA to android phones?

Radmin_85 · ‎01-14-2019

Hello we have PA 220 model and when we implement SSL decryption we can observe the ping delay in our trust interface.THE cpu load is 50 % when we turn off the SSL decryption everything is normal

Radmin_85 · ‎11-16-2018

@MickBall Hmm i dont know why it is being offered first

Radmin_85 · ‎11-15-2018

@MickBall I have only one public ip with NAT.And i can not ping this public IP from internal side.I need to go out and then come back again somehow to ping my external Ip

Radmin_85 · ‎11-15-2018

Hello all We have configured GP REMOTE ACCESS VPN with OTP authentication. Ones we try to connect to Portal it failed to pass at the first time only second time.In Radius server we see that it tries to authenticate first the Ldap account then VPN account we configured the followings and it is ok.And i would like to know is it best practice from security point of view

Radmin_85 · ‎11-15-2018

@MickBall Mike i guess we must configure split DNS in order to connect to the same FQDN whether we are inside the LAN or outside It is not best practice to connect to your outside ip through your gateway device. In GP there is internal Gateway.I guess the internal gateway is the method by which you can connect to portal through your internal gateway

Radmin_85 · ‎11-14-2018

@Rajesh12 @MickBall So in order to connect to outside IP i have to configure it as gateway under internal host detection ?

Radmin_85 · ‎11-14-2018

@MickBall The problem is that In GP application there is an option which says that when the user takes the corporate notebook and go home to connect to home Wi fi and to work he must connect the to GP portal first otherwise you can not get access to anything even Internet from home When that user comes back to office and connect his Notebook to corporate LAN he get the local network ip address but at the same time tries to connect to GP portal (because of user logon).So it can not connect to outside IP and that is why the user can not get access to anywhere even though it got the local ip address from DHCP So there must be some mechanism when user connect his laptop to internal lan in the office it must recognize the local network and must connect to other gateway.i guess that must be internal gateway

Radmin_85 · ‎11-14-2018

@MickBall just added it for internal host detection

Radmin_85 · ‎11-14-2018

@MickBall I created an extra internal gateway without tunnel mode.That is what i mean

Radmin_85 · ‎11-14-2018

@MickBall you have not give the address pool?

Radmin_85 · ‎11-14-2018

@MickBall i guess i even can not connect to Portal too Because normally when i type in browser the internal gateway i must get into the page where i usually download the GP agent app.But i even can not do it.It ask for certificate and then when i use certificate it says bad request IT is everything ok when i do it outside the network,But the problem is when i try to connect inside the corporate network

Radmin_85 · ‎11-14-2018

hello @Rajesh12 Yes we did it but the problem is when PA try to connect to that gateway (without tunnel mode) it asks for certificate and we use the same certificate (company certificate) which we use to connect to PA outside network (which is ok) it says Bad request So as i understand the host could not reach to portal even to see the internal host identification and that is why can not recognize internal network

Radmin_85 · ‎11-14-2018

Hello all we have mobile clients with GP which use corporate notebooks at home .It was configured user logon option to force the notebook to connect through GP when it connects to home WI-FI When the same worker comes back to workplace and plugged in the ethernet cable they still use the same GP network Is there any way to force the client notebook to recognize the internal network and dont use GP with user logon option in place?

Radmin_85 · ‎11-14-2018

Ok we could resolve this solution But one more point When the worker connect to corporate network through GP at home with user-logon option it is ok But when that worker returns to workplace with the same corporate notebook it still remains in GP network Is it possible to force the PA or GP agent to recognize the internal network when one plugged in the ethernet cable in workplace and dont connect through GP agen with user-logon option?

Radmin_85 · ‎11-12-2018

Hello Alexander Yes the authentication is via LDAP Thanks we will try ones more

Radmin_85 · ‎11-12-2018

we did it but it seems dont work correctly

Radmin_85 · ‎11-06-2018

Is there a guide how to configure it with groups?

Radmin_85 · ‎11-05-2018

Hello all We have one public IP address and two groups of users who must connect to Head Office but get different policies We decide to use loopback ip address and NAT it to the public one but with different port (for example loopback ip 1.1.1.1 and public ip is 85.10.10.1 and we NATed 85.10.10.1:446 to 1.1.1.1:443) but when client try to connect to public IP with that port it says :This address was not found is there any guide how to realize it correctly?

Radmin_85 · ‎10-18-2018

Hello We have 3CX server - IP telephony inside the network.When we pass the SIP traffic through PA it gets problems We try to connect through SIP :5060 port o outside server on ISP side but it doesnt work we made application override and also disabled ALG It is natted also by PA itself have you ever some problems regarding SIP?

Radmin_85 · ‎10-10-2018

How can i do report of some users during last week? i mean web surfing report

Radmin_85 · ‎09-27-2018

Hello we have PA 5220 and we need to connect SFP+ modules.We have Finisar SFP plus module but it does not work Can you recommendme any third party SFP+ module which is sure to work

Radmin_85 · ‎09-27-2018

The certificate is from Go daddy -Wild certificate But it happens only with MS EXCHANGE SERVER We have other web servers.It is ok with them

Radmin_85 · ‎09-27-2018

As you see from screenshot it is intrazone traffic. But it was resetted from server side.what you mean whether it ssl inspection is enabled?

Radmin_85 · ‎09-26-2018

hello we have EXCHANGE server at TRUST zone.When we try to make SSL inbound inspection to this server active sync does not work and even when we try to open OWA via browser we get an error ERR _ SSL _ VERSION _ OR _ CIPHER _ MISMATCH Is there any idea where can be the problem?

Radmin_85 · ‎09-24-2018

Hello all There is a task.The Management want to see what employers do during work time.Which sites they surf and so on We have Palo Alto PA-850 Is it possible to show them in real time which user surfing which web site.I mean real time surfing? I know that there is USER ACTIVITY REPORT. But it is not allow us to see in real time user surfing like In some software firewalls. And the management want some report where they can see which users visit which sites Is it possible to make such kind of report?

Radmin_85 · ‎09-18-2018

thanks for the answer it is pity that there is no anti-spam module in Palo Alto .Check Point has it

Radmin_85 · ‎09-17-2018

hello İn the network users get many spams.We dont have any other anti-spam solution.Is it possible to stop spams by Palo Alto NGFW?

Radmin_85 · ‎07-25-2018

We have a task where users should access to Internet by username and Password.I guess it is PROXY concept but is there any alternative in PA?

Radmin_85 · ‎07-18-2018

admin@paloalto> debug user-id dump hip-profile-database statistics Total number of hipmask in database: 9 Total number of logout records in database: 75 Total size of hip reports: 1033KB used / 740352KB admin@paloalto> debug user-id dump hip-profile-database ipmapping Total number of ipmappings in database: 0 No record exists or matches! admin@paloalto> debug user-id dump hip-profile-database entry Total number of hipmask in database: 9 Total number of logout records in database: 75 Total size of hip reports: 1033KB used / 740352KB No record exists or matches!

Date Registered	‎08-01-2017 02:05 AM
Date Last Visited	‎02-22-2019 07:02 AM
Total Messages Posted	146
Total Likes Received	7

Online Status	Offline
Date Last Visited	‎02-22-2019 07:02 AM

Strata

Prisma

Cortex

About Radmin_85