I think he posted a discussion when he watned to post a document. ... View more

We disabled IPsec on our PA500.  Tried reconnecting the SSL Client but still getting the same error.  I can see the clients attempting to connect but are never assigned an IP address from my SSL pool; but other clients are getting IP addresses.  Is it possible that 443 is used for authentication and another port is used for data ? Is there a debug command i can use to view authentications and data coming into the firewall? ... View more

SOLUTION :When setting up the Agent service on the domain controller you will want to have the settings under the "Recovery" tab to be "Restart the Service" for First/Second/Subsequent failures and to have the restart service timer at 1 minute. This works for Server 2003 R2 environments. ... View more

show user ip-user-mapping ip 10.7.1.60 IP address:  10.7.1.60 User:        unknown Ident. By:   Unknown Idle Timeout: 651s Max. TTL:    1551s Groups that user belong to (used in policy) i have changed the settings on the agent to disable the NetBIOS/WMI checking. Have reset all other values to defaults.  What should i try next? Thanks for you help! ... View more

Eugene - Have you configured the outside addresses for your nat tables yet? I think you also might have the subnetting or the addresses wrong.  For L3 connections with a /32 this is used for Point-to-point links, if you were to have a single link from the ISP.  If this setup is currently working double check your subnets used. /32 indicates PA-2020 (100.100.100.197/32) --> ISP (100.100.100.198/32) We'll work on getting basic connectivity now: GOTO:  Objects tab and make sure you have the proper outside address in the ADDRESS menu.  Make sure you are using the IP Netmask configuration with just a single IP address per config. Policies > NAT -- make sure you have a rule saying trust to untrust you are doing source address translation.  You will be doing Port and IP address translation and using the OUTSIDE address you just configured. Under the Network tab > Interfaces do you have zones set, virtual router (internal and external interfaces need to be on the same router).  Both untagged and both have a L3 interface type. Under Network > Virtual Routers -- check your vitual router has a default route to the outside world. Destination 0.0.0.0/0 Net hop type: IP Next hop value: GATEWAY-PROVIDED BY YOUR ISP (100.100.100.100) FOR doing the NAT to your web server at 10.1.1.2/32 you will do the following: Object > ADDRESS - add your external address used for your server (100.100.100.197?) Policies > NAT -- make a new rule. Source zone: untrust Destination zone: trust Destination Address: choose the new 100.100.100.197? address you just created service: http/https/whatever service you are using. destination translation: translation address 10.1.1.2                                   translated port - can leave blank or use 80/443 if you want. commit and be awesome. let us know if any of this was helpful. ... View more

Also you could try disabling NetBIOS lookups on the Agent.  Check the box to disable Netbios, save, OK and then restart the PanAgent service. ... View more

I have the same 2 domain setup and use logon scripts that run as DOMAIN\Administrator to map drives and such, but doesn't affect USER-IDs.  How did you come to the conclusion that its based on your mapped drives?  Can you isolate the user with its own rules and then re-map a drive and have the same outcome? A lot of times with our USER-ID agents the agents time-out and all users get tossed into my "ALL OTHERS" rule, which causes some conflict.  Changing the time-out time on the agent and a simple reboot can fix this. Are you using 4.0.1?  Seems this problem has occurred more often in 4.0.1 for our organization. ... View more

Also high priority, the people using this VPN can't do their reports unless they have the VPN connection. ... View more