Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
- Panorama
- AIOps for NGFW
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- Cloud NGFW for AWS
- CN-Series
- VM-Series:
- Private Cloud
- OCI
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
- Cortex Xpanse
Security Operations
- Resources
- COVID-19 Response Center
About inclusa-admin
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About inclusa-admin
06-25-2021
9Posts
0Likes
0Solutions
Jun 25, 2021Last Visited
User
Activity
User
Profile
Latest posts by inclusa-admin
| Subject | Views | Posted |
|---|---|---|
| 6503 | 07-15-2020 05:47 PM | |
| 714 | 05-12-2020 06:22 AM | |
| 7443 | 04-15-2020 04:42 PM | |
| 7463 | 04-15-2020 04:26 PM | |
| 7691 | 04-15-2020 12:19 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like |
User Badges
Community Statistics
| Member Since | 05-31-2018 10:46 AM |
| Date Last Visited | 06-25-2021 12:09 PM |
| Posts | 9 |
07-15-2020
05:47 PM
We are in the development phase of deploying a large number of new laptops to our user base. Due to the current circumstances with COVID and the changes we have made for out employees we would like to allow our users to receive the devices directly and utilize Intune for the deployment along with GlobalProtect pre-logon functionality. We currently have a working setup to utilize machine certificate based pre-logon along with SAML after Windows login. Our Intune profiles are successfully pushing the certificates and GlobalProtect Client before the end point attempts to join the domain, but the client never seems to attempt to connect to the portal. I was hoping others have gone down this path and had some insight on how to get this to successfully work or if it is even possible. Any information would be helpful since Microsoft has no good information on the process. Our setup is as follows: PANOS - 9.1.3 GlobalProtect Client - 5.1.5 Certificate Chain on both the Firewall as well as all clients Portal Configuration - pre-logon configuration agent first then SAML authentication second with auto generated cookies to manipulate the configuration agent being used. Gateway Configuration - both portal agents point to the same gateway and require a client certificate with the root and intermediate configured within a certificate profile. As mentioned the pre-logon method works without any issue in production, but when we attempt to deploy a workstation using Microsoft Intune Windows 10 Out of Box or AutoPilot the process fails. I see a lot of MS documentation about using UWP GlobalProtect and am not sure on if it is required.
... View more
05-12-2020
06:22 AM
Hello, We have been building out several IPSec L2L VPN tunnels from Azure instance to several of our branch offices and have come across an interesting issue with a few of the newly created tunnels. The issue we are seeing is that the tunnel sessions are being created properly using IKE, but when phase 2 begins the firewall is establishing the IPSec sa's over both IPSec-ESP as well as UDP 4500. We have NAT-T disabled on both the Palo Alto VM and the remote Cisco/Juniper edge routers. The remote end is only creating the SA over ESP and not over UDP 4500. I have attempted to clear the sessions from the Palo Alto, but it continues to attempt this connection even though NAT-T is disabled. This issue only seems to occur with newly created tunnels. We are running PANOS 9.1.2 Please let me know if anyone has seen such behaviour or if there is something that can be done to completely disable NAT-T on the tunnels. Thanks in avance
... View more
04-15-2020
04:42 PM
Thanks for the information. We are not using a SHA1 cert and I do have a TAC case open at this time. The strange thing is everything was working without issue up until Monday of this week. Rebooting the firewall is a fix, but not the one I like.
... View more
04-15-2020
04:26 PM
This issue started occurring on Monday morning. We had recently updated our domain certificate last week, but did not see any issues up until the past week. The following error is what I am seeing in the logs (T1388) 04/13/20 11:26:59:346 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_RESOLVING_NAME, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:347 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_NAME_RESOLVED, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:347 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_CONNECTING_TO_SERVER, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:393 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_CONNECTED_TO_SERVER, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:425 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_SECURE_FAILURE, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:425 Info (3359): winhttpObj, dwCertError is: (T7560) 04/13/20 11:26:59:425 Info (3365): WINHTTP_CALLBACK_STATUS_FLAG_SECURITY_CHANNEL_ERROR (T7560) 04/13/20 11:26:59:425 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:425 Debug(3419): WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, error=12175, result=5, dwCertificateError=-2147483648 (T7560) 04/13/20 11:26:59:425 Debug(4970): we get cert error, so remove previousCertificate (T9052) 04/13/20 11:26:59:461 Debug(4930): send alive message now 3 (T9052) 04/13/20 11:26:59:461 Info (2188): winhttpObj, get WINHTTP_CALLBACK_STATUS_REQUEST_ERROR (T9052) 04/13/20 11:26:59:461 Info (2190): winhttpObj, ERROR_WINHTTP_SECURE_FAILURE set (T9052) 04/13/20 11:26:59:461 Info (1577): Server cert query failed with error 12019 (T9052) 04/13/20 11:26:59:461 Debug(1489): DC, dump server certificate now (T11200) 04/13/20 11:26:59:461 Debug( 563): Send command to Pan Service (T11200) 04/13/20 11:26:59:461 Debug( 590): Command = <request><type>pan_msg_ping</type><result>3</result></request> (T11200) 04/13/20 11:26:59:461 Debug( 642): PanClient sent successful with 80 bytes (T9052) 04/13/20 11:26:59:461 Debug(1530): DC, read 2167 of 2167 bytes from file <Removed for security>\AppData\Local\Palo Alto Networks\GlobalProtect\ServerCert.pan. (T9052) 04/13/20 11:26:59:461 Debug(1395): DC, exportFirstCert (T9052) 04/13/20 11:26:59:461 Debug(1472): DC, could not find right property id, last error=80092004 (T9052) 04/13/20 11:26:59:461 Error(2218): error = ERROR_WINHTTP_SECURE_FAILURE (T9052) 04/13/20 11:26:59:461 Debug(4379): do not enforce 1.2, retry it now (T9052) 04/13/20 11:26:59:461 Info (2105): winhttpObj, SendRequest, m_clientCertName=(null), bIngoreClientCert=0 (T9052) 04/13/20 11:26:59:462 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_RESOLVING_NAME, this=00000206F9DC73E0) (T9052) 04/13/20 11:26:59:462 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_NAME_RESOLVED, this=00000206F9DC73E0) (T9052) 04/13/20 11:26:59:462 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_CONNECTING_TO_SERVER, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:493 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_CONNECTED_TO_SERVER, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:530 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_RESOLVING_NAME, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:530 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_NAME_RESOLVED, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:530 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_CONNECTING_TO_SERVER, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:561 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_CONNECTED_TO_SERVER, this=00000206F9DC73E0) (T9052) 04/13/20 11:26:59:571 Debug(4930): send alive message now 3 (T11200) 04/13/20 11:26:59:571 Debug( 563): Send command to Pan Service (T11200) 04/13/20 11:26:59:571 Debug( 590): Command = <request><type>pan_msg_ping</type><result>3</result></request> (T11200) 04/13/20 11:26:59:571 Debug( 642): PanClient sent successful with 80 bytes (T7560) 04/13/20 11:26:59:597 Info (3346): PanWinhttpCallback(dwInternetStatus=WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, this=00000206F9DC73E0) (T7560) 04/13/20 11:26:59:597 Debug(3419): WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, error=590615, result=5, dwCertificateError=-2147483648 (T9052) 04/13/20 11:26:59:680 Info (2188): winhttpObj, get WINHTTP_CALLBACK_STATUS_REQUEST_ERROR (T9052) 04/13/20 11:26:59:680 Info (2190): winhttpObj, ERROR_WINHTTP_SECURE_FAILURE set (T9052) 04/13/20 11:26:59:680 Info (1577): Server cert query failed with error 12019 (T9052) 04/13/20 11:26:59:680 Debug(1489): DC, dump server certificate now (T9052) 04/13/20 11:26:59:680 Debug(1530): DC, read 2167 of 2167 bytes from file <Removed for security>\AppData\Local\Palo Alto Networks\GlobalProtect\ServerCert.pan. (T9052) 04/13/20 11:26:59:680 Debug(1395): DC, exportFirstCert (T9052) 04/13/20 11:26:59:680 Debug(1472): DC, could not find right property id, last error=80092004 (T9052) 04/13/20 11:26:59:680 Error(2218): error = ERROR_WINHTTP_SECURE_FAILURE (T9052) 04/13/20 11:26:59:680 Error(4540): winhttpObj, error! ipaddress <Removed for security>
... View more
04-15-2020
12:19 PM
Our organization has started noticing that every 24 hours (give or take an hour) new connections to our Global Protect VPN service is rejecting new connections to the appliance. We also notice that the portal landing page stops responding and issues a generic SSL Error and the page cannot be displayed. The issue is only resolved by rebooting the firewall. We are running an Azure VM-300 and have roughly 1000 users connecting throughout the day. No major changes have recently occured to the configuration. Version 9.0.5.xfr GP Version 5.0.5 Any thoughts?
... View more
01-10-2019
06:25 AM
I think I understand now. I really appreciate your responses on this and pointing me to the correct path.
... View more
01-10-2019
05:59 AM
Thank you for your replies, it is much appreciated. As of right now we have done nothing to tweak the agent configuration and is using the default setup with SSO authentication. We do not actually have any PaloAlto gateways internally at the moment. As of right now we only have the 1 Azure VM firewall. From what I understand we would need an interface from a PaloAlto internally to achieve this correct? Forgive me for any ignorance on this. My past experience has been mainly with Pulse and Cisco and am a bit green with GlobalProtect.
... View more
01-10-2019
05:41 AM
The tunnel will always establish if the gateway is reachable, which it is since the host sits in Azure. We have modified DNS to not resolve the gateway when on the LAN, but the client will display an error message stating it cannot connect. I am not seeing anything within the configuration to state only connect if not on the domain/local network. Am I missing something? Again any help is appreciated.
... View more
01-10-2019
04:57 AM
Hello, We are currently migrating from Cisco AnyConnect to a GlobalProtect solution that is hosted on an Azure cloud VM and really like the "Always On" feature. The only set back we have noticed is there is no way to manipulate it to only connect when not on an internal LAN. We had manipulated DNS in the past to disable internal users from connecting to our VPN, but with the GlobalProtect client it will display an error message. We are trying to avoid having our end users notice this. Thank you any assistance is appreciated.
... View more
- Tags:
- globalprotect
- vpn
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-25-2021
12:09 PM
|
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks
