About jesuscano

jesuscano

Thanks for your response Bpry So, you mean in UIA Agent config to add the LAN network in "incluted list of configured networks", right? or you mean to disable WMI probing (this could cause impact) https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClbkCAC So we also should disable Probin in PA config? " Go to Device >> User Identification On the "User Mapping" tab, in the "Palo Alto Networks User ID Agent" pane, view the "Enable Probing" check box. If it is selected, this is a finding.

jesuscano

Hi, We need to know why our UIAs are starting sessions to INTERNET in port 135. how can we mitigate this flow? WE disblae UIA in INTERNET zone but we still see these sessions. Here you can see the kind of sessions: any idea?

jesuscano

Hi Reaper, Just doubt: Its compatible FW in 8.0.13 with UIA in 9.0.0? Is there any issue having UIA two majors above Fws?

jesuscano

Hi, Just to confirm. it would be compatible this: UserIdagent in version 9.0.x and FWs in version 8.0.13 WE need to upgrade FWs to version 9.0.x, and we are thinking to upgrade first UIA, but we are not sure about compatibility in UIA two major higher.

jesuscano

Hi, I explain my scenario: We need a cluster A/P in 8.0.x. We had issues upgrading when the LACP didnt come up in the passive node jumping to 8.1.10. So in the last try we realised that jumping to base 8.1.0 the LACP interfaces were up. So we will do this upgrade path: 8.0.13->8.1.0->9.0.0-> 9.0.9-h1. Customer has UIA 8.1.6 version Panorama 8.1.6 My questions are: -What would you do with Panorama and UserId agent. Can we upgrade them before FWs. Is working Panorama and UIA in 9.0, and FWs in 8.0.x? -How do you organize this in order to upgrade all platfom?

jesuscano

But NEtBIOS is not port 135. I think it would have more convenient disabling WMI probing. This can be a risk in the normal behavior for UIA. Anyway, i dont understand why UIA are starting sessions to public low reputation IPs

jesuscano

Hi, We are detecting in Palo FW that there are sessions from UseriD-Agent servers to publics IPs. Our SOC confirmed that some of these public IPs are categorized like low reputation. Sessions are in port 135. I know the UserId agent uses this port but its reaching publics IPs. We have GP enabled, and there are also connections port 135 to the public client IPs. But there are anothe sessions to low reputatio ips Why its having this behaviour? Any way to avoid these sessions from UIA to public IPS?.

jesuscano · ‎07-27-2020

Hi, Im having the same grade because of: This server does not support Forward Secrecy with the reference browsers. how did you solve it? any idea?

jesuscano · ‎07-27-2020

Hi, Did you solve this? We launched ssllabs to a GP portal website and it shows this: This server does not support Forward Secrecy with the reference browsers Is there any way to support PFS for GP portal web?

jesuscano · ‎07-27-2020

Hi, We launched a sslab test for a GlobalProtect Portal website. Our note is B. We would like to improve these two things but we dont know what it can be done in PA config. These are: There is no support for secure renegotiation. MORE INFO » This server does not support Forward Secrecy with the reference browsers. Grade capped to B. MORE INFO » What means "secure renegotiation"? how can solve this in PA? what about Palo support froward secrecy? anything to do in Palo?

jesuscano · ‎07-08-2020

Hi Bpry, We have configurar a PA 5260 in order to use the AUX ip to contact (services routes AUX int) with panorama, but when we register the FW in panorama is added with IP MGMT FW IP. why? its that normal?

jesuscano · ‎06-23-2020

Yes, we have the license GP Gateway trial (for 3 months): License entry: Feature: GlobalProtect Gateway Description: GlobalProtect Gateway License Issued: June 17, 2020 Expires: September 15, 2020 Expired?: no ---------------------- PanOS is 8.0.13 (i know its in EoS but we had issues upgrading and with covid19 is stuck)

jesuscano · ‎06-23-2020

GP datafile (for HIP) is not in GP tab. The GP Data file is in "dynamic updates" tab. Screenshot:

jesuscano · ‎06-23-2020

Hi, We have the trial license until august.

jesuscano · ‎06-23-2020

Hi, We tried to schedule "download and install" for GP data file but we can not see any GP data file version in dynamic updates. We are using the GP gateway trial (3months) license. It could be for this? The rest of dynamic updates (app, AV) are working fine, so it does not seem connectivity issue.

jesuscano · ‎06-22-2020

We still see traffic logs with zoom application and port 443. The config for zoon split is ok.

jesuscano · ‎06-22-2020

Hi, I upgraded the clients to 5.1.3 GP version. but we still see traffic logs for zoom ips in port 443. Why?

jesuscano · ‎06-11-2020

As a result of the covid, many clients with GP are asking me about the possibilities for implementation DFA with Palo Alto GP. I was checking about client certificate config in GP but i think this is not very safe at all. What recommendation/DFA do you have?

jesuscano · ‎05-29-2020

what you mean with NLA? The point is that if we add the gateway the issue are solved....weird...

jesuscano · ‎05-29-2020

I have the same issue. Port 8801 is going through GP tunnel and some 443 zoom-base sessions. How did you solve it? any idea?

jesuscano · ‎05-29-2020

Hi, I see the same issue. I configured split for zoom app using domain and apps tab. I can see traffic in port 8801 reaching the tunnel. Any way to split this 8801port traffic?

jesuscano · ‎05-29-2020

We configured the zoon split tunneling using domain and application but we see that sessions to zoom using port 8801. These 8801 sessions are going through the tunnel. Is there any way to split this traffic?

jesuscano · ‎05-27-2020

Yes, i know appid and userid. But i mean, in the corporate laptop users can access to personal Gdrive accounts in storage cloud (gdrive). Is there any way to prevent that? Only access to storage in the cloud using the corporate account. I think its not possible to do it.

jesuscano · ‎05-27-2020

Is there any way to filter onedrive? by user account? we would like to filter the access. any idea?

jesuscano · ‎05-27-2020

The IP we added for panGP gateway was the PAlo ALTO IP tunnel interface for GP

jesuscano · ‎05-27-2020

Hi, We have issues with a service using GP. To solve it we add the IP Palo GP tunnel in the PanGP adapter gateway in local machine. Why this is happening? is there any way to configure this pangp gateway from palo alto when user connects in GP?

jesuscano · ‎05-26-2020

192.168.1.1 is the ip for the tunnel GP. Network -> Interfaces->tunnel.1 (192.168.1.1) If we add in PanGP adaprter the gateway the ip_tunnel is working fine why? is there any way to configure the gateway for PanGP adapter from the FW?

jesuscano · ‎05-26-2020

HI, I mean that we have a GP. Some clients (192.168.1.20-192.168.1.50 range) had connectivity issues dowloading the system center (AV). So we went to PanGPadapter and we dont see any gateway for PanGP adapter. So we tried to add this GP gateway (192.168.1.1), and it worked. SO is there any way to assign a gateway for PanGP interface from PA config? hy PanGP doesnt have gateway?

jesuscano · ‎05-19-2020

we have the correct ranges but its like the clients are not splitting the traffic and this traffic is still going through the tunnel. Is it needed to restart the agent or any action in GP to refresh?

jesuscano · ‎05-18-2020

We add all IPs in the excluded but if i go to monitor session i can see traffic to these IPs in PA. Its like GPclient is not taking the routes added properly.

Date Registered	‎03-16-2018 04:12 AM
Date Last Visited	yesterday
Total Messages Posted	195
Total Likes Received	4

Online Status	Online
Date Last Visited	yesterday

Strata

Prisma

Cortex

About jesuscano