This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About inclusa-admin
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About inclusa-admin
01-29-2023
9Posts
0Likes
0Solutions
Jan 29, 2023Last Visited
User
Activity
User
Profile
Latest posts by inclusa-admin
| Subject | Views | Posted |
|---|---|---|
| 9168 | 07-15-2020 05:47 PM | |
| 1206 | 05-12-2020 06:22 AM | |
| 10040 | 04-15-2020 04:42 PM | |
| 10060 | 04-15-2020 04:26 PM | |
| 10371 | 04-15-2020 12:19 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like |
User Badges
Community Statistics
| Member Since | 05-31-2018 10:46 AM |
| Date Last Visited | 01-29-2023 10:47 PM |
| Posts | 9 |
07-15-2020
05:47 PM
We are in the development phase of deploying a large number of new laptops to our user base. Due to the current circumstances with COVID and the changes we have made for out employees we would like to allow our users to receive the devices directly and utilize Intune for the deployment along with GlobalProtect pre-logon functionality. We currently have a working setup to utilize machine certificate based pre-logon along with SAML after Windows login. Our Intune profiles are successfully pushing the certificates and GlobalProtect Client before the end point attempts to join the domain, but the client never seems to attempt to connect to the portal. I was hoping others have gone down this path and had some insight on how to get this to successfully work or if it is even possible. Any information would be helpful since Microsoft has no good information on the process. Our setup is as follows: PANOS - 9.1.3 GlobalProtect Client - 5.1.5 Certificate Chain on both the Firewall as well as all clients Portal Configuration - pre-logon configuration agent first then SAML authentication second with auto generated cookies to manipulate the configuration agent being used. Gateway Configuration - both portal agents point to the same gateway and require a client certificate with the root and intermediate configured within a certificate profile. As mentioned the pre-logon method works without any issue in production, but when we attempt to deploy a workstation using Microsoft Intune Windows 10 Out of Box or AutoPilot the process fails. I see a lot of MS documentation about using UWP GlobalProtect and am not sure on if it is required.
... View more
05-12-2020
06:22 AM
Hello, We have been building out several IPSec L2L VPN tunnels from Azure instance to several of our branch offices and have come across an interesting issue with a few of the newly created tunnels. The issue we are seeing is that the tunnel sessions are being created properly using IKE, but when phase 2 begins the firewall is establishing the IPSec sa's over both IPSec-ESP as well as UDP 4500. We have NAT-T disabled on both the Palo Alto VM and the remote Cisco/Juniper edge routers. The remote end is only creating the SA over ESP and not over UDP 4500. I have attempted to clear the sessions from the Palo Alto, but it continues to attempt this connection even though NAT-T is disabled. This issue only seems to occur with newly created tunnels. We are running PANOS 9.1.2 Please let me know if anyone has seen such behaviour or if there is something that can be done to completely disable NAT-T on the tunnels. Thanks in avance
... View more
04-15-2020
04:42 PM
Thanks for the information. We are not using a SHA1 cert and I do have a TAC case open at this time. The strange thing is everything was working without issue up until Monday of this week. Rebooting the firewall is a fix, but not the one I like.
... View more
04-15-2020
04:26 PM
This issue started occurring on Monday morning. We had recently updated our domain certificate last week, but did not see any issues up until the past week. The following error is what I am seeing in the logs (T1388) 04/13/20 11:26:59:346 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_RESOLVING_NAME, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:347 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_NAME_RESOLVED, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:347 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_CONNECTING_TO_SERVER, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:393 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_CONNECTED_TO_SERVER, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:425 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_SECURE_FAILURE, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:425 Info (3359): winhttpObj, dwCertError is: (T7560) 04/13/20 11:26:59:425 Info (3365): WINHTTP_CALLBACK_STATUS_FLAG_SECURITY_CHANNEL_ERROR (T7560) 04/13/20 11:26:59:425 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:425 Debug(3419): WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, error=12175, result=5, dwCertificateError=-2147483648 (T7560) 04/13/20 11:26:59:425 Debug(4970): we get cert error, so remove previousCertificate (T9052) 04/13/20 11:26:59:461 Debug(4930): send alive message now 3 (T9052) 04/13/20 11:26:59:461 Info (2188): winhttpObj, get WINHTTP_CALLBACK_STATUS_REQUEST_ERROR (T9052) 04/13/20 11:26:59:461 Info (2190): winhttpObj, ERROR_WINHTTP_SECURE_FAILURE set (T9052) 04/13/20 11:26:59:461 Info (1577): Server cert query failed with error 12019 (T9052) 04/13/20 11:26:59:461 Debug(1489): DC, dump server certificate now (T11200) 04/13/20 11:26:59:461 Debug( 563): Send command to Pan Service (T11200) 04/13/20 11:26:59:461 Debug( 590): Command = <request><type>pan_msg_ping</type><result>3</result></request> (T11200) 04/13/20 11:26:59:461 Debug( 642): PanClient sent successful with 80 bytes (T9052) 04/13/20 11:26:59:461 Debug(1530): DC, read 2167 of 2167 bytes from file <Removed for security>\AppData\Local\Palo Alto Networks\GlobalProtect\ServerCert.pan. (T9052) 04/13/20 11:26:59:461 Debug(1395): DC, exportFirstCert (T9052) 04/13/20 11:26:59:461 Debug(1472): DC, could not find right property id, last error=80092004 (T9052) 04/13/20 11:26:59:461 Error(2218): error = ERROR_WINHTTP_SECURE_FAILURE (T9052) 04/13/20 11:26:59:461 Debug(4379): do not enforce 1.2, retry it now (T9052) 04/13/20 11:26:59:461 Info (2105): winhttpObj, SendRequest, m_clientCertName=(null), bIngoreClientCert=0 (T9052) 04/13/20 11:26:59:462 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_RESOLVING_NAME, this=00000206F9DC73E0) (T9052) 04/13/20 11:26:59:462 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_NAME_RESOLVED, this=00000206F9DC73E0) (T9052) 04/13/20 11:26:59:462 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_CONNECTING_TO_SERVER, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:493 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_CONNECTED_TO_SERVER, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:530 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_RESOLVING_NAME, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:530 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_NAME_RESOLVED, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:530 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_CONNECTING_TO_SERVER, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:561 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_CONNECTED_TO_SERVER, this=00000206F9DC73E0) (T9052) 04/13/20 11:26:59:571 Debug(4930): send alive message now 3 (T11200) 04/13/20 11:26:59:571 Debug( 563): Send command to Pan Service (T11200) 04/13/20 11:26:59:571 Debug( 590): Command = <request><type>pan_msg_ping</type><result>3</result></request> (T11200) 04/13/20 11:26:59:571 Debug( 642): PanClient sent successful with 80 bytes (T7560) 04/13/20 11:26:59:597 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:597 Debug(3419): WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, error=590615, result=5, dwCertificateError=-2147483648 (T9052) 04/13/20 11:26:59:680 Info (2188): winhttpObj, get WINHTTP_CALLBACK_STATUS_REQUEST_ERROR (T9052) 04/13/20 11:26:59:680 Info (2190): winhttpObj, ERROR_WINHTTP_SECURE_FAILURE set (T9052) 04/13/20 11:26:59:680 Info (1577): Server cert query failed with error 12019 (T9052) 04/13/20 11:26:59:680 Debug(1489): DC, dump server certificate now (T9052) 04/13/20 11:26:59:680 Debug(1530): DC, read 2167 of 2167 bytes from file <Removed for security>\AppData\Local\Palo Alto Networks\GlobalProtect\ServerCert.pan. (T9052) 04/13/20 11:26:59:680 Debug(1395): DC, exportFirstCert (T9052) 04/13/20 11:26:59:680 Debug(1472): DC, could not find right property id, last error=80092004 (T9052) 04/13/20 11:26:59:680 Error(2218): error = ERROR_WINHTTP_SECURE_FAILURE (T9052) 04/13/20 11:26:59:680 Error(4540): winhttpObj, error! ipaddress <Removed for security>
... View more
04-15-2020
12:19 PM
Our organization has started noticing that every 24 hours (give or take an hour) new connections to our Global Protect VPN service is rejecting new connections to the appliance. We also notice that the portal landing page stops responding and issues a generic SSL Error and the page cannot be displayed. The issue is only resolved by rebooting the firewall. We are running an Azure VM-300 and have roughly 1000 users connecting throughout the day. No major changes have recently occured to the configuration. Version 9.0.5.xfr GP Version 5.0.5 Any thoughts?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-29-2023
10:47 PM
|
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks