LIVEcommunity - About inclusa-admin

inclusa-admin · ‎07-15-2020

We are in the development phase of deploying a large number of new laptops to our user base. Due to the current circumstances with COVID and the changes we have made for out employees we would like to allow our users to receive the devices directly and utilize Intune for the deployment along with GlobalProtect pre-logon functionality. We currently have a working setup to utilize machine certificate based pre-logon along with SAML after Windows login. Our Intune profiles are successfully pushing the certificates and GlobalProtect Client before the end point attempts to join the domain, but the client never seems to attempt to connect to the portal. I was hoping others have gone down this path and had some insight on how to get this to successfully work or if it is even possible. Any information would be helpful since Microsoft has no good information on the process. Our setup is as follows: PANOS - 9.1.3 GlobalProtect Client - 5.1.5 Certificate Chain on both the Firewall as well as all clients Portal Configuration - pre-logon configuration agent first then SAML authentication second with auto generated cookies to manipulate the configuration agent being used. Gateway Configuration - both portal agents point to the same gateway and require a client certificate with the root and intermediate configured within a certificate profile. As mentioned the pre-logon method works without any issue in production, but when we attempt to deploy a workstation using Microsoft Intune Windows 10 Out of Box or AutoPilot the process fails. I see a lot of MS documentation about using UWP GlobalProtect and am not sure on if it is required.

inclusa-admin · ‎05-12-2020

Hello, We have been building out several IPSec L2L VPN tunnels from Azure instance to several of our branch offices and have come across an interesting issue with a few of the newly created tunnels. The issue we are seeing is that the tunnel sessions are being created properly using IKE, but when phase 2 begins the firewall is establishing the IPSec sa's over both IPSec-ESP as well as UDP 4500. We have NAT-T disabled on both the Palo Alto VM and the remote Cisco/Juniper edge routers. The remote end is only creating the SA over ESP and not over UDP 4500. I have attempted to clear the sessions from the Palo Alto, but it continues to attempt this connection even though NAT-T is disabled. This issue only seems to occur with newly created tunnels. We are running PANOS 9.1.2 Please let me know if anyone has seen such behaviour or if there is something that can be done to completely disable NAT-T on the tunnels. Thanks in avance

inclusa-admin · ‎04-15-2020

Thanks for the information. We are not using a SHA1 cert and I do have a TAC case open at this time. The strange thing is everything was working without issue up until Monday of this week. Rebooting the firewall is a fix, but not the one I like.

inclusa-admin · ‎04-15-2020

This issue started occurring on Monday morning. We had recently updated our domain certificate last week, but did not see any issues up until the past week. The following error is what I am seeing in the logs (T1388) 04/13/20 11:26:59:346 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_RESOLVING_NAME, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:347 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_NAME_RESOLVED, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:347 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_CONNECTING_TO_SERVER, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:393 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_CONNECTED_TO_SERVER, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:425 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_SECURE_FAILURE, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:425 Info (3359): winhttpObj, dwCertError is: (T7560) 04/13/20 11:26:59:425 Info (3365): WINHTTP_CALLBACK_STATUS_FLAG_SECURITY_CHANNEL_ERROR (T7560) 04/13/20 11:26:59:425 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:425 Debug(3419): WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, error=12175, result=5, dwCertificateError=-2147483648 (T7560) 04/13/20 11:26:59:425 Debug(4970): we get cert error, so remove previousCertificate (T9052) 04/13/20 11:26:59:461 Debug(4930): send alive message now 3 (T9052) 04/13/20 11:26:59:461 Info (2188): winhttpObj, get WINHTTP_CALLBACK_STATUS_REQUEST_ERROR (T9052) 04/13/20 11:26:59:461 Info (2190): winhttpObj, ERROR_WINHTTP_SECURE_FAILURE set (T9052) 04/13/20 11:26:59:461 Info (1577): Server cert query failed with error 12019 (T9052) 04/13/20 11:26:59:461 Debug(1489): DC, dump server certificate now (T11200) 04/13/20 11:26:59:461 Debug( 563): Send command to Pan Service (T11200) 04/13/20 11:26:59:461 Debug( 590): Command = <request><type>pan_msg_ping</type><result>3</result></request> (T11200) 04/13/20 11:26:59:461 Debug( 642): PanClient sent successful with 80 bytes (T9052) 04/13/20 11:26:59:461 Debug(1530): DC, read 2167 of 2167 bytes from file <Removed for security>\AppData\Local\Palo Alto Networks\GlobalProtect\ServerCert.pan. (T9052) 04/13/20 11:26:59:461 Debug(1395): DC, exportFirstCert (T9052) 04/13/20 11:26:59:461 Debug(1472): DC, could not find right property id, last error=80092004 (T9052) 04/13/20 11:26:59:461 Error(2218): error = ERROR_WINHTTP_SECURE_FAILURE (T9052) 04/13/20 11:26:59:461 Debug(4379): do not enforce 1.2, retry it now (T9052) 04/13/20 11:26:59:461 Info (2105): winhttpObj, SendRequest, m_clientCertName=(null), bIngoreClientCert=0 (T9052) 04/13/20 11:26:59:462 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_RESOLVING_NAME, this=00000206F9DC73E0) (T9052) 04/13/20 11:26:59:462 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_NAME_RESOLVED, this=00000206F9DC73E0) (T9052) 04/13/20 11:26:59:462 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_CONNECTING_TO_SERVER, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:493 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_CONNECTED_TO_SERVER, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:530 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_RESOLVING_NAME, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:530 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_NAME_RESOLVED, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:530 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_CONNECTING_TO_SERVER, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:561 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_CONNECTED_TO_SERVER, this=00000206F9DC73E0) (T9052) 04/13/20 11:26:59:571 Debug(4930): send alive message now 3 (T11200) 04/13/20 11:26:59:571 Debug( 563): Send command to Pan Service (T11200) 04/13/20 11:26:59:571 Debug( 590): Command = <request><type>pan_msg_ping</type><result>3</result></request> (T11200) 04/13/20 11:26:59:571 Debug( 642): PanClient sent successful with 80 bytes (T7560) 04/13/20 11:26:59:597 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:597 Debug(3419): WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, error=590615, result=5, dwCertificateError=-2147483648 (T9052) 04/13/20 11:26:59:680 Info (2188): winhttpObj, get WINHTTP_CALLBACK_STATUS_REQUEST_ERROR (T9052) 04/13/20 11:26:59:680 Info (2190): winhttpObj, ERROR_WINHTTP_SECURE_FAILURE set (T9052) 04/13/20 11:26:59:680 Info (1577): Server cert query failed with error 12019 (T9052) 04/13/20 11:26:59:680 Debug(1489): DC, dump server certificate now (T9052) 04/13/20 11:26:59:680 Debug(1530): DC, read 2167 of 2167 bytes from file <Removed for security>\AppData\Local\Palo Alto Networks\GlobalProtect\ServerCert.pan. (T9052) 04/13/20 11:26:59:680 Debug(1395): DC, exportFirstCert (T9052) 04/13/20 11:26:59:680 Debug(1472): DC, could not find right property id, last error=80092004 (T9052) 04/13/20 11:26:59:680 Error(2218): error = ERROR_WINHTTP_SECURE_FAILURE (T9052) 04/13/20 11:26:59:680 Error(4540): winhttpObj, error! ipaddress <Removed for security>

inclusa-admin · ‎04-15-2020

Our organization has started noticing that every 24 hours (give or take an hour) new connections to our Global Protect VPN service is rejecting new connections to the appliance. We also notice that the portal landing page stops responding and issues a generic SSL Error and the page cannot be displayed. The issue is only resolved by rebooting the firewall. We are running an Azure VM-300 and have roughly 1000 users connecting throughout the day. No major changes have recently occured to the configuration. Version 9.0.5.xfr GP Version 5.0.5 Any thoughts?

inclusa-admin · ‎01-10-2019

I think I understand now. I really appreciate your responses on this and pointing me to the correct path.

inclusa-admin · ‎01-10-2019

Thank you for your replies, it is much appreciated. As of right now we have done nothing to tweak the agent configuration and is using the default setup with SSO authentication. We do not actually have any PaloAlto gateways internally at the moment. As of right now we only have the 1 Azure VM firewall. From what I understand we would need an interface from a PaloAlto internally to achieve this correct? Forgive me for any ignorance on this. My past experience has been mainly with Pulse and Cisco and am a bit green with GlobalProtect.

inclusa-admin · ‎01-10-2019

The tunnel will always establish if the gateway is reachable, which it is since the host sits in Azure. We have modified DNS to not resolve the gateway when on the LAN, but the client will display an error message stating it cannot connect. I am not seeing anything within the configuration to state only connect if not on the domain/local network. Am I missing something? Again any help is appreciated.

inclusa-admin · ‎01-10-2019

Hello, We are currently migrating from Cisco AnyConnect to a GlobalProtect solution that is hosted on an Azure cloud VM and really like the "Always On" feature. The only set back we have noticed is there is no way to manipulate it to only connect when not on an internal LAN. We had manipulated DNS in the past to disable internal users from connecting to our VPN, but with the GlobalProtect client it will display an error message. We are trying to avoid having our end users notice this. Thank you any assistance is appreciated.

Member Since	‎05-31-2018 10:46 AM
Date Last Visited	a month ago
Posts	9

Online Status	Offline
Date Last Visited	a month ago

Microsoft Intune Out of Box Experience and Autopilot Hybrid AD Join

Azure VM-300 IPSec VPN Tunnels and NAT-T

Re: Global Protect Portal Failures

Re: Global Protect Portal Failures

Global Protect Portal Failures

Re: GlobalProtect VPN "Always On"

Microsoft Intune Out of Box Experience and Autopilot Hybrid AD Join

Azure VM-300 IPSec VPN Tunnels and NAT-T

Re: Global Protect Portal Failures

Re: Global Protect Portal Failures

Global Protect Portal Failures

Re: GlobalProtect VPN "Always On"

Re: GlobalProtect VPN "Always On"

Re: GlobalProtect VPN "Always On"

GlobalProtect VPN "Always On"

Network Security

Cloud Security

Security Operations