About rchung54

rchung54 · ‎08-11-2020

@RamprakashRT Thanks for your reply. I have lately been testing with Thinfinity RDP gateway and that works very well. I am curious about SAML on Guacamole so will configure and test that too at some point.

rchung54 · ‎07-13-2020

Hi, In the middle of POC testing accessing internal servers via RDP, using Clientless VPN and Guacamole. The Clientless VPN and Guacamole side are already set up and working fine. This is how I would like to see the POC working: 1. External users connect to the Clientless VPN gateway. 2. Enter their 2-Factor-Authentication details (I will be using SecurEnvoy as the 2FA software). 3. Log into the Clientless VPN portal page. 4. Users click on the Guacamole RPD link within the Clientless VPN page and go straight to the list of RDP sessions within Guacamole, instead of logging into the Guacamole admin web page. Is it possible to bypass the Guacamole web page where you normally enter 'guacadmin', then the password? If not, this means a user will have to login three times ie. first into the 2FA software, then the Clientless VPN page and lastly the Guacamole web page. Many thanks. Roberto

rchung54 · ‎12-13-2019

@BruceBennett @MickBall Our mail is hosted by a company for the UK public health service. When on the LAN, we connect to the Exchange servers with a private IP range, via our public health ISP/WAN provider.. When off LAN, ie. in a public airport lounge, we can still connect to the same Exchange servers for our mail, via public IPs. Don't know the full set up of the Exchange servers, as this is managed externally, but that's what I've figured out. I expected MS Outlook just to work, once I was logged in via GlobalProtect, as effectively, I was on the corporate LAN. Mapping to shared drives etc all worked fine along with everything else. Just seemed bizarre MS Outlook didn't. How I eventually got MS Outlook to work via GlobalProtect, was I had to create a static route with the private IP range and point it back into my inside LAN facing interface (my Trust zone). All been fine since.

rchung54 · ‎12-13-2019

Thanks Steve, It would be a nice feature to have.

rchung54 · ‎12-12-2019

I have deployed the GlobalProtect Always-On VPN via the MSI.exe, where the external gateway is specified. The GP client installs fine on the Windows endpoints. The remote user logs into the Win 10 endpoint with their Windows domain credentials as normal. As they have never connected via the GP client before, they are prompted to enter their Windows domain credentials onto the GP client, the user is then authenticated and the GP client connects fine. Each time the remote user connects again, they just enter their Windows domain credentials at the Windows logon screen and they are connected, without having to enter their Windows domain credentials onto the GP client again. That's great. Just as I expected it to work. Is there a way to bypass entering their Windows domain credentials onto the GP client the first time a user logs in? Just think it'll be one less step for the user to do, upon that initial connecting via the GP client. Any thoughts and advice is much appreciated. Robert

rchung54 · ‎12-10-2019

Hi Bruce, Perhaps getting Wireshark on to see how the packets flow and start from there. Using Wireshark helped me to see which IP MS Outlook was connecting to, then I needed to get the IP (and subnet) confirmed by the company hosting our Exchange servers. It sounds like using MS O365 is more complicated, but good luck. Robert

rchung54 · ‎12-09-2019

@SteveCantwell Hi Steve, managed to solve the issue myself. I needed the IPs for the specific mail servers we connect to. Once they were confirmed, I put in a static route for the IPs and Outlook now works. Thanks for your tips on this. Robert

rchung54 · ‎11-26-2019

Hi Steve, Thanks for your reply. I created a security policy to allow the traffic, but Outlook is still not connecting. Logs show bytes being sent, but none are being received. Was hoping the security policy would resolve this. Have logged a TAC case for advice.

rchung54 · ‎11-25-2019

Hi, I have GP Always-On VPN configured and my test Windows 10 machine connects to the gateway and accesses internal LAN resources fine. MS Outlook 2010 doesn't seem to connect when I am connected via the GP client. Outlook just keeps saying 'Trying to connect to server'. On one occasion, the MS Outlook prompt did appear for me to enter my password. This was done, but it was still saying 'Trying to connect to server'. When I left the machine for some time, Outlook looked it connected, as my mailbox contained the latest emails. Our Exchange mail is hosted externally, as we are part of National Health sector in the UK. I configured the Windows Defender firewall on my Windows 10 machine to allow the GlobalProtect client through the firewall, but made no difference. Has anyone else experienced this with MS Outlook connected via GlobalProtect? Regards, Robert

rchung54 · ‎04-24-2019

@jeremy.larsen Hi Jeremy, do you mean a switch between Internal Router A (and B) and Firewall 1 (and 2) and use VRRP or HSRP?

rchung54 · ‎04-23-2019

@ jeremy.larsen So, I've been labbing this up and have created the floating static routes on all the routers as you mentioned. In steps 12 and 13 of the configuration guide, it says redistribute the floating static routes upstream and downstream. Does this mean I have to create a Redistribution Profile on the Palo Alto and add it to the Export Rules in OSPF? Many thanks in advance.

rchung54 · ‎04-23-2019

Hi Jeremy, Thank you for your reply. Why the floating static routes are used, does make sense, in case OSPF does fail, the traffic will still flow. So I would configure a static route on Edge Routers A and B (the upstream routers), pointing to the Datacentre LAN. And a static route pointing to the Internet/0.0.0.0/0, on Internal Routers A and B (the downstream routers). Is this correct for this scenario? An Active/Active option is not possible as the Palo's will be 25 miles apart from each other (for DR purposes). The two Palos will be connected via the HA link over 2 x L2 links between two sites. One of these L2 links will be the primary (the active) and the other will be the secondary (the backup link), hence exploring the Active/Passive design option. Please let me know if I am right about the configs of the static routes, on those routers.

rchung54 · ‎04-18-2019

Hi, I came across this design guide and looking at labbing this up for testing, as the design could be a good fit for our production environment, with a few tweaks. In my case, I'll be using OSPF between the firewalls and internal routers A and B. The connections to the edge routers A and B will be the provider routers, so they will be outside facing and I won't be running OSPF between them. I have a few question about the floating static routes mentioned: 1. are these floating static routes configured on internal router A and edge router A? 2. are these floating static routes also configured on the Palo Alto as static routes? As the screen shots show them being on the Palo Alto. Just to get my upstream and downstream routers right: 1. Is the upstream router edge router A? 2. Is the downstream router Internal router A? Anyone used this design on their production network? Any limitations, advantages/disadvantages with the design? Your advice and thoughts are appreciated.

rchung54 · ‎02-11-2019

Hi pulukas, rmfalconer, Otakar.Klier, Thank you for your responses and advice. @OtakarKlier- Both the Palo's can ping each other if I source the IPs, even when I don't have static rule set up I lab'd this up again following the Site-to-Site VPN with Static and Dynamic Routing config guide in the PAN-OS 8.1 Admin guide and got the tunnels up with the remote sites pinging each other. However, it did take a bit of tweaking with trial and errors, until I got the config working. The config steps are not clear in the Admin guide, if one is new to Palo Alto and VPNs. These are the observations I made when I lab'd this up again. 1. On the IKE Gateway configuration, the Admin. guide said use the FQDN for the local and peer identification. This did not work for me in my lab. Instead, I used the following config on both Palo's, by specifying the Peer IP address and the local and the IP peer addresses for the Local and Peer identification: 2. I was told that static routes pointing down tunnels should not have a next hop address defined. If it did not, how would the secure traffic travel across the tunnel? in order for my config to work, i had to specify the Next Hop IP address of the tunnel interface. 3. Both my Palo Alto's do not see each other as OSPF neighbours. Surely they would only see each other as OSPF neighbours, if both Palo's had OSPF running on them? Not sure why the guide stated this, only one of the Palo's has OSPF configured. The peer VM-PA-02 which has OSPF configured. has formed a neighbour relationship with router R1 fine. Anyone else had to tweak things to their configs working? Many thanks.

rchung54 · ‎02-08-2019

@pulukas Hi pulkas, I have created this profile (underlined in red), is this what you mean?

rchung54 · ‎02-08-2019

@OtakarKlier Thank you for your reply. I can't ping between the two Palo's on IPs 192.168.210.26 and 192.168.210.120, which are assigned to their e1/1 interfaces. I have set up statics routes anda security policy as follows on both Palo's as suggested. VM-PA-01 config. VM-PA-02 config. Any further advice is appreciated.

rchung54 · ‎02-07-2019

Hello forum members, I have been testing the VPN site-2-site configurations on my Palo Alto VM lab, prior to deploying on our production environment. I have successfully set up a VPN connection where both firewalls use static routing. Trouble I'm having now is setting up the VPN connection where the 3rd party site uses static routing and my corp LAN uses OSPF. I can't get the tunnel up between the two sites. I followed the Site-2-Site VPN with Static and Dynamic Routing example in the PAN-OS Admin guide, but some of the steps seem vague (vague to me any way). My R1 router has formed an OSPF neighbour relation ship with the Palo Alto VM-PA-01 fine and the PC host 172.19.9.10 can ping the E1/2 interface (10.216.7.1) of the Palo Alto fine. The following is my lab topology and screen shots of the configs. VM-PA-01 config. *** I also tried this IKE Gateway config with the FQDNs, as in the PAN-OS guide *** VM-PA-02 config. *** I also tried this IKE Gateway config with the FQDNs, as in the PAN-OS guide *** Any suggestions and advice will be much appreciated.

rchung54 · ‎12-20-2018

Hi Rikkert_Kooy, Yes, i saw the three error messages at the same time on the Filezilla client. The Session End Reason is 'tcp-rst-from-server'. What does it mean where it says 'incomplete' under Application please? Thanks.

rchung54 · ‎12-20-2018

Hi DPoppleton, I set the Transfer Settings to Active in the FTP client (I guess this what you meant), but still not working. I did what Rikkert_Kooy suggested too and still no joy. Is it because the Palo is not configured with SSL decrypt/encrypt? Thanks.

rchung54 · ‎12-20-2018

Hi Rikkert_Kooy, Thank you for your reply. My mistake, it is explicit FTP over SSL, not SFTP. I have added ftp to the Application and already had TCP port 990 under the Service. I also added SSL and the port range 50000-51000, but it is still not working. The Palo is not configured for SSL decrypt/encrypt. Could this be why it is still not working? Unified logs - it says incomplete in Application. What does this mean please? Error message on the Filezilla client Thanks.

rchung54 · ‎12-11-2018

Hi DPoppleton, Still not working. I get this from the log in the Filezila FTP client. Filezila client configured as so for FTP over SSL/TLS Logs from Unified today. Any further advice will be appreciated.

rchung54 · ‎12-05-2018

@DPoppleton, forgot to mention that the Filezilla client was configured for SFTP and was tested on a ADSL line and the user was able to connect fine. Thanks, Roberto

rchung54 · ‎12-05-2018

Hi DPoppleton, Thanks for your reply again. I have now added SSH under Application within my rule. I will have the user test. Many thanks, Roberto

rchung54 · ‎12-04-2018

Hi DPoppleton, I don't see any 'deny' in the Actions when the user is trying to access 195.171.192.29

rchung54 · ‎12-04-2018

Hello Hodor, Thanks for your reply. The file blocking profile looks good.

rchung54 · ‎12-04-2018

Hello, A colleague needs to access ftp.sophos.com (195.171.192.29) using Filezilla as their SFTP client, via TCP port 990. I set up the security policy rule as follows: They could not log onto the ftp.sophos.com site. The password credentials they used are correct. Is the rule set up correctly? On a Cisco ASA I would have used the following ACL: access-list aclinside extended permit tcp any host 195.171.192.29 eq 990 Any advice is much appreciated. Regards, Roberto

rchung54 · ‎11-26-2018

Hi Raido, Thank you again for your advice. Regards, Roberto

rchung54 · ‎11-21-2018

Hello Raido, Thank you for your reply. I created a test report with the following settings, to see how much traffic was going out a particular interface (Ethernet1/10 is the interface I am interested in). I get the following result when I do 'run now'. Am I right that it gives me the total in bytes going out the interface? What does the 'G' mean when I look at 804.5G under bytes? It would be good if the report could tell the average bandwidth going out interface Ethernet 1/10 per day in a calender month. Any further advice you could give is much appreciated. Many thanks in advance. Roberto

rchung54 · ‎11-20-2018

Hello Palo experts, I want to create a report which tells me what bandwidth has been used on an outside interface, for say the past month. Something that can display the average bandwidth being used during a day would be good. I see on my PA-3050 that under Network>QoS, that live bandwidth stats can be displayed, but can't see where I can export monthly bandwidth stats. Any advice or tips will be much appreciated. Best regards, Roberto

rchung54 · ‎11-12-2018

Hi Venkatesan_radhakrishnan, Thank you for your prompt reply and clarifying that. Best regards, Roberto

Date Registered	‎05-21-2018 05:33 AM
Date Last Visited	13 hours ago
Total Messages Posted	31
Total Likes Received	3

Online Status	Offline
Date Last Visited	13 hours ago

Strata

Prisma

Cortex

About rchung54