Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- 5G
- IoT Security
- Prisma SD-WAN
Network Security
- Prisma Access
- Prisma SaaS
- Prisma Cloud
- CN-Series
- VM-Series:
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
Security Operations
- Resources
- COVID-19 Response Center
- LIVEcommunity
- ›
- About mlinsemier
About mlinsemier
Announcements
Changes to the LIVEcommunity experience are coming soon... Here's what you need to know.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
13 hours ago
82Posts
32Likes
6Solutions
Apr 11, 2021Last Visited
User
Activity
User
Profile
Latest posts by mlinsemier
| Subject | Views | Posted |
|---|---|---|
| 26 | Friday | |
| 45 | Friday | |
| 134 | 2 weeks ago | |
| 156 | 3 weeks ago | |
| 216 | 3 weeks ago |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 | 02-17-2021 12:40 PM | |
| 1 | 03-16-2018 09:32 AM | |
| 1 | 03-19-2018 02:16 PM | |
| 2 | 03-16-2018 07:59 AM | |
| 2 | 03-16-2018 08:42 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 2 | |||
| 2 | |||
| 2 |
User Badges
Public Statistics
| Date Registered | 09-11-2014 10:13 AM |
| Date Last Visited | 13 hours ago |
| Total Messages Posted | 82 |
| Total Likes Received | 32 |
Friday
Already discovered a new bug with VPN disconnecting when a user locks the Windows 10 screen or if it goes idle locks and then turns off. Note that it the laptop is not going into sleep mode, screen powers off only. It would stay connected indefinitely under 5.2.5-c84. . Certificate Based Pre-Login to User-Login configuration.
... View more
Friday
I just did a test upgrade from 5.2.5-c84 which we were running which solved a majority of our issues (as there was only 5 new issues fixed in 5.2.6).. New Problem: I am seeing the VPN tunnel disconnected when I lock the Windows 10 screen or it locks due to going idle timeout. Now I see "GlobalProtect Status: Disconnected" and it doesn't automatically reconnect. Its not that the laptop has to wake up because on power it never goes to sleep, just the screen will turn of. In 5.2.5-c84 I would stay connected indefinitely. Edit: Looks like the GlobalProtect service is crashing and the client/service isnt running when I log back in. Clean uninstall and reinstall did not resolve the issue. I reinstalled and retested the 5.2.5-c84 client and it has been stable for the last 12+ hours and is staying connected regardless of rebooting, logging on and off, and user and idle locking of the screen. I am going to open a ticket with Palo Alto to investigate.
... View more
2 weeks ago
Is the only reason you don't want to use machine certificates is that you don't have an internal root CA? I have spent an extensive amount of time configuring machine-based certificate pre-login along with SSO + SAML Authentication integration and the config is quite intricate. In my experience there are so many scenarios in which tokens can be invalidated (new application installs, configuration changes, IP changes, etc.) for either the portal or gateway I just can't see this working consistently. I would also agree that not using a machine certificate could create a pretty big security hole especially if you are creating and relying on tokens with long lifetimes. If you don't have a internal root CA you could consider using self signed certificate(s) if your deployment is not large as they could be deployed easily through a GPO. Edit: This is a very comprehensive explanation on configuring pre-login and interactive logins for GlobalProtect: https://live.paloaltonetworks.com/t5/blogs/globalprotect-overview/ba-p/322170 - Good luck
... View more
3 weeks ago
We currently have GlobalProtect deployed utilizing a combination of certificates (for pre-login) and SSO + SAML (to Azure AD) for user authentication. The SAML portion redirects the users to the Microsoft MFA portal for 6 digit authentication when they log in. This is working without pretty much flawlessly. The issue comes into play when a user stays logged into their machine (interactive login) and their authentication expires and prompts the user to re-authenticate via the Microsoft MFA portal and are not at their machine to do so, therefore it times out and the host is no longer authenticated and no longer reachable on the network. Short of forcing machines to log off at night (which would switch the tunnel back to pre-login mode) or using the OS (Windows Welcome) to handle the MFA portion, does anyone know of a workaround to this? Ultimately this is causing us problems on weekends when we want to patch and a user simply doesn't log off. Thanks in advance for any input you may have.
... View more
3 weeks ago
I currently have pre-login working with SSO + SAML with Azure MFA... the issue that I see is that when a user stays logged in for a time greater than their time required to reauthenticate via MFA, the machine is stuck in a limbo state during this time. Has anyone else experienced this and does anyone know of a workaround?
... View more
02-17-2021
12:40 PM
1 Kudo
Just a quick update on this older topic that under PANOS 10.0.x, the DNS Sec license is now integrated in the policy and you can no longer make this change. Additionally, you cannot change the built-in default policy either. The kicker is that my Palo Alto account manager offered to sell me DNS Security licenses to get rid of the error and the TAC Engineer told me that its "cosmetic and just a warning" and to file a feature request through my account manager. I love when my security team sends me messages every day asking why where are warnings in Panorama about security policies being committed with warnings. Hopefully as more of us move towards 10.0.x Palo Alto will do something about this. It frustrating as this option shouldn't be configurable if we don't have a license. -Matt
... View more
05-29-2020
08:12 AM
Two weeks and no responses... I guess I will open a ticket with Palo Alto to try to determine the cause.
... View more
05-13-2020
09:34 AM
Starting in either PAN-OS 8.1.x or 9.0.x we have noticed that SNMP is reporting inbound discards on all of our Palo Alto management interfaces in our monitoring solutions. It seems to be be specific only to the management interface as other physical interfaces of the device are not reporting issues. Has anyone here experienced this? I'm looking for a workaround to see if I can clear up these errors in our tool.
... View more
06-28-2018
10:51 AM
I didn't get that far as by the time I drove into the office i was well into my maintenance window and just needed to get the network back up (there should have been no outage due to HA). I've upgraded tons of HA clusters in the past and never seen this. Even a single firewall with the HA pair turned off would continuously boot to red alarm and then restart. In the meantime I opened a ticket with Palo Alto and already am planning to migrationg to 8.0.10 (which I have running on other non-HA firewalls) and see if I have similar issues. I've hit new bugs on upgrades, but never reboot issues. On a side note, it's good to hear it worked for you.
... View more
06-27-2018
10:03 PM
I performed an upgrade on a HA Pair of PAN-5220 firewalls from PAN-OS 8.0.7 to PAN-OS 8.0.11 and once the firewalls booted up they would run for about 5 minutes, alarm (red LED on device) and then reboot, over and over and over. Even with only one firewall running on PAN-OS 8.0.11, it would eventually alarm and reboot. Thankfully the devices stayed up long enough to revert the software back to PAN 8.0.7, which came up without any issues. I know its newer software, but it's a point release and now recommened due to Palo Alto Networks Security Advisory - PAN-SA-2018-0003. I am going to open a ticket tomorrow with Palo Alto for follow up but I would certainly be wary of this version if you have similar configuration. - Matt
... View more
06-05-2018
11:44 AM
Okay, that makes sense because I paired down the "Allowed IPs" that the remote Palo Alto's are looking for IP to User Mappings. For the audit events, are you speaking of the Event Viewer on the domain controller itself?
... View more
06-05-2018
10:06 AM
@reaper Thanks for the reply on this. So i started completley from scratch on my configuration in attempts to more easily troubleshoot. Without any networks in the include list, I get no IP addresses in the Monitoring Tab under discovered users. When I add an office IP range to the Discovery, i start seeing logs such as these. IP x.x.x.x is not in the include list IP x.x.x.x is not in the include list IP x.x.x.x is not in the include list IP x.x.x.x is not in the include list IP x.x.x.x is not in the include list IP x.x.x.x is not in the include list When I add one of these networks which I know has users on it, the error in debug goes away, but the Monitor still shows 0 IPs. It's almost like it is seeing the IP's from the domain controllers as it writes them in the log, but then is not saving them. This is why I was asking about normal operation with just log reading on as I was thinking perhaps monitoring only was for addresses that were also polled. Completely confused here. -Matt
... View more
06-04-2018
06:25 PM
All, When we first installed our User-ID Agent service on Windows Server 4-5 years ago we implemented Security Log Reading (from domain controllers logs), AD Session Scanning, and MWI polling. About 5-6 days ago we started running into issues (which we have yet to determine what is causing it), where polling seems to be openeing up multiple connections at a time causing our WAN optimizer to start trying to optimize 10x connections than normal. After delving into the latest best practices, it seems that Session Scanning and MWI polling are no longer recommended, and just reading the AD logs and Syslogs are the best way to go. Question: If I just enable reading the windows logs from the domain controllers, should it be populating the User-ID agent with IP addresses of users? When I turn off session scanning and WMI probing, the IP list is empty. As I've always used all three options, I'm not sure if what is "normal" and I can't find any supporting documentation that explains one way or the other. Sincerely, -Matt
... View more
04-05-2018
11:29 AM
We are using the 10G TwinAX Copper with PAN-5220 firewalls and were using them with our legacy PAN-5050 and PAN-5060 firewalls without issue.
... View more
03-20-2018
07:42 AM
Is this a dump of show routing fib ? It looks a bit different on my 8.x device? Any chance you have policy based routing configured? - Matt
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
13 hours ago
|
Latest Tags
No tags yet
Latest Blogs
Latest Posts
Copyright 2007 - 2021 - Palo Alto Networks
