About campbech1

Just completed an install this last weekend and received a report that a user wasn't able to connect to GlobalProtect. I started with the normal troubleshooting and quickly realized this was going to be something more detailed.   The user that initially complained said that she wasn't able to connect to GP. I asked them to just try to hit the portal with a web browser and make sure she could get there first. Nope, can't reach the portal via a browser.   Next step I did some monitoring and packet captures on the firewall and verified I can see their traffic hitting the firewall on the GP portal address but I'm only seeing packets in one direction. I see the client hello in the packet capture but I don't ever see the server hello and then certificate exchange, it just stops there on the client. Performing a packet capture on the firewall I see in the tx capture that the server hello is being sent and also verified this with a packet capture downstream from the firewall. The server hello just never makes it to the remote client.   The client is able to ping the GP portal fine.   It appeared that this was an isolated issue with this one client, but I'm now finding that my cell phone, when on my home Internet, I'm able to connect, but on AT&T wireless I'm not.   Any one have any ideas?   One more piece to the puzzle. The client is able to connect to other devices with SSL on the same network here and is also able to VPN to the existing Cisco ASA that's here without any issues. The only issue is to the GP portal.   I sat on a call with Palo support for the last two days without any resolution.   Hardware: PA-460 in HA Version: 10.1.4 GP versions tried 5.2.10 and 6.0 ... View more

I'm currently migrating from a pair of Cisco ASAs and the zones have me a little confused.   Right now I have interfaces on the ASAs of inside, wireless, outside, dmz-private-web, dmz-private-db, dmz-public-web, dmz-public-db, dmz-dev-web, dmz-dev-db.   My plan was to group the inside and wireless together as "trusted", outside as "outside, and then all of the DMZ zones as "DMZ".   When the interfaces are placed into a single zone like that, hopefully rules are still required between them? ... View more

We have had some requirements change since ordering this equipment and may change direction on where these new firewalls get installed.   Initially we ordered the 3260s for our hosted data center since most of the servers are located there and vendor provided backup solution is there. The concern was the amount of traffic that we would be pushing through the firewall during backup times. All of the server VLANs are terminated on the firewalls. That direction is changing now. We are looking to move the servers back to our corporate location where we had planned on the 850s to be installed.   A long term direction was proposed today to bring these servers back in-house by the end of the year which changes where I potentially place these firewalls. I'm now looking at installing the 850s at the hosted data center and the 3260s at our corporate location (data center).   Am I able to write a policy to allow hosts to talk to other hosts through the firewall but to disable the APP-ID and threat prevention policies to allow traffic to flow at the 10G speeds? This would be related to backup traffic in particular.   Thank you in advance. This should be an interesting weekend installing these since I've been a Cisco engineer for the past 20 years. ... View more

Does the credential phishing policy require the URL filtering license?   Thank you. ... View more