This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About uscit
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About uscit
08-18-2015
28Posts
0Likes
0Solutions
Aug 18, 2015Last Visited
User
Activity
User
Profile
Latest posts by uscit
| Subject | Views | Posted |
|---|---|---|
| 3575 | 07-10-2013 09:48 AM | |
| 3731 | 07-10-2013 07:45 AM | |
| 3731 | 07-10-2013 06:19 AM | |
| 3921 | 07-09-2013 08:31 AM | |
| 2852 | 05-20-2013 04:47 PM | |
| 1872 | 05-15-2013 07:10 AM | |
| 1953 | 05-10-2013 11:35 AM | |
| 2406 | 05-08-2013 01:33 PM | |
| 2554 | 05-07-2013 07:04 AM | |
| 9954 | 04-26-2013 11:47 AM |
User Badges
Community Statistics
| Member Since | 12-18-2012 11:42 AM |
| Date Last Visited | 08-18-2015 09:06 AM |
| Posts | 28 |
07-10-2013
09:48 AM
I did that this morning, and it worked fine. Thanks!
... View more
07-10-2013
07:45 AM
The backup ISP and PBF rule scenario was already created, in place and working for a few months now. I'm only concerned with the new MPLS connections at this time. Thanks though.
... View more
07-10-2013
06:19 AM
With the new MPLS, access from those multiple sites to my internal LAN and vice versa is needed. I'll test with static routes in the PrimaryVR for all the outside MPLS sites.
... View more
07-09-2013
08:31 AM
We have setup in our PA-500 two ISP interfaces: Primary (eth1/1) is our primary Internet connection, and the Secondary (eth1/2) is our Backup ISP (configured for failover, and this one also is an MPLS connection to another site). Eth1/3 is our private LAN. There are two virtual routers setup for this scenario (also including GlobalProtect configurations): Routes: PrimaryVR default - destination: 0.0.0.0 - type: ip-address - value: <primary ISP> gp - destination: <GP private addressing> - interface: tunnel-1 LAN - destination: <private LAN> - type: next-vr - value: SecondaryVR SecondaryVR default - destination 0.0.0.0 - type: ip-address - value <secondary ISP> gp - destination: <GP private addressing> - type: next-vr - value: PrimaryVR Now, we have a new circuit brought in that will MPLS to the company that acquired ours. I've set up eth1/4 for the interface to the new MPLS, and I've set up addresses/groups for all the locations in the new MPLS, Security Zone, NAT, Policy Based Forwarding (traffic destined for the new MPLS to use eth1/4). Where I have questions is how to configure the static routing in the virtual routers for the new MPLS connections. Do I have to setup a third virtual router with the default going to the MPLS gateway? If so, what routes under that do I add to connect it to the other two virtual routers? Or, do I just add the eth1/4 interface to say PrimaryVR and the Policy Based Forwarding rule will route to the appropriate interface instead of the default value (but then do I add static routes for all the other MPLS site locations in the router too)? Looking for some advice.
... View more
05-20-2013
04:47 PM
I ran into a scenario that rendered me useless remotely, and I'm wondering if I can configure secondary authentication for GlobalProtect... I used GP to VPN in remotely. My GP is set up to authenticate through Active Directory, and it works fine. I was updating my VMWare environment and SAN, in which I needed to power down all VMWare servers (including Domain Controllers). During my SAN upgrades, I lost my GP connection. From that point, I couldn't re-establish my GP connection and it took me a minute to realize that it was because AD could not be contacted due to it being offline. I had to go on-site to finish all upgrades and restore the servers. Is there a way to configure GP to allow a local login for myself if AD authentication doesn't work so that I can still connect to the PAN firewall, then I can manage my network without the reliance of AD when I know it's not going to be available (bring VMs back up)?
... View more
05-15-2013
07:10 AM
The Facebook app works fine when not behind the PAN firewall. When behind it, becuase of the SSL Decryption, it will not connect to Facebook. I've tried installing the decryption certificate on the iOS device, but it doesn't help.
... View more
05-10-2013
11:35 AM
Regarding SSL Decryption: I originally put the whole category of "social-networking" under a Decrypt rule (mainly to decrypt Facebook to block Facebook games). However, when I tested on my iPhone after that, LinkedIn, Twitter and Facebook all had "network errors" and basically wouldn't connect and pull down information. I then removed the "social-networking" group from the Decrypt rule, and added in a Custom group for Facebook. LinkedIn and Twitter work fine on my iPhone connectivity-wise now, and Facebook still gives a "network error" and won't update. From what I read, TLS1.2 is not supported on the PA devices (I'm on 5.0.4), but traffic was supposed to still pass through. Why can I not still retrieve content updates on these social networking apps when SSL Decryption is turned on for them?
... View more
05-08-2013
01:33 PM
Well, it appeared that I actually did have the chain wrong on my GP SSL cert (a Godaddy one). I corrected that, and now I don't get an error in the PAN when committing...however if I use openssl or sslToolbox to validate the chain, it's throwing in an extra cert that I did not put in the chain. Openssl says it is a "self-signed certificate in the certificate chain", and this is from sslToolbox below: Certificate Chain Information Server Name <gp portal> was checked using port number 443 The following issuer is not supported by the certificate installation checker. Chain Installation Certificate 1 Organization The Go Daddy Group, Inc. OU Go Daddy Class 2 Certification Authority Country US Valid From Tue Jun 29 13:06:20 EDT 2004 Valid To Thu Jun 29 13:06:20 EDT 2034 Serial Number 0 Signature Algorithm SHA1withRSA I then looked in the PA-500's "Default Trusted Certificate Authorities" and indeed there is one called "The Go Daddy Group, Inc., Go Daddy Class 2 Certification Author". I don't remember seeing this in there before, and I had looked for GoDaddy in this default trusted list? And for the warning about the untrust cert, I saw the other thread that said to ignore this error. I don't have an untrust cert...if I want to set one up to get rid of the warning, is it any different than the one I use for forward trust? Can I just use that one for both?
... View more
05-07-2013
07:04 AM
I had setup GlobalProtect with a third party certificate that I chained together, and it works fine with no errors. Then, I began testing SSL Decryption yesterday (with an initial goal of decrypting SSL for Facebook so that I could block Facebook games). Upon configuring the Decryption Policy, when going to commit, I receive these warnings: Warning: certificate chain not correctly formed in certificate GlobalProtect-ServerWarning: certificate chain not correctly formed in certificate GlobalProtect-ServerWarning: vsys1 decryption: forward decrypt untrust cert is not configured, forward decrypt trust cert will be used instead. (Module: device) Configuration committed successfully My questions are: Why is it now telling me that my chain isn't configured correctly for the cert I'm using with GlobalProtect? The cert I'm using for SSL Decryption I have only enabled the option of "Forward Trust Certificate", which I am assuming is why I'm seeing the warning about "Forward decrypt untrust cert is not configured, forward decrypt trust cert will be used instead"...but should I enable "Forward Untrust Certificate" on this cert as well?
... View more
04-26-2013
11:47 AM
That's what my whole conundrum is about...ISP #2 is a secondary ISP, configured to be a failover if ISP #1 goes down, but can also be used for Internet access by the main site. The P-2-P across the MPLS is configured through that ISP #2 circuit, so I have both types of traffic (private and public) going on it.
... View more
04-26-2013
11:31 AM
do you have Ping enabled in the Management Profile on the interface(s) that they cannot ping you on?
... View more
04-26-2013
09:07 AM
I tested through VPN on my iPhone, and that source user shows up in the logs. I noticed that for my computer, I got some sporadic ones where it shows "domain\administrator" as a source user doing a ping. It then dawned on me that those entries are from Spiceworks on my PC checking the network with the domain admin account. I also wasn't directing my own PC through the PA, which threw me off when seeing the "domain\administrator" entries from my IP address (still kind of does, becuase the traffic was being logged even though my PC wasn't going through the PA as a gateway). I directed my PC through the gateway, and then browsed the web, and my source user entry shows up fine. Just have to figure out the easiest way to get the remote subnet working without putting User-ID on the untrust ISP#2 zone.
... View more
04-26-2013
07:51 AM
The IP subnet in the remote site is 192.100.101.0/24. The IP of a client PC there, for instance, is 192.100.101.51. I'm sure there is NATing through the MPLS connection, but the PA in the traffic log shows the source address being 192.100.101.51. I can check to verify that there is an entry in the DC's security logs for this client, but I also know that it's not showing a source user for any computer there (there are more than one PC there set up to go through the PA). We have Windows 2012 DC's, is there any difference in the Agentless setup between Windows 2008 DC's and Windows 2012 DC's for the security logs it tails? I obviously wouldn't enable User-ID on that untrusted "ISP#2" zone that those clients MPLS through, so I guess I have to revert to something else for them. And as for my PC, I'll try delving through those DC logs as well.
... View more
04-25-2013
09:40 PM
More questions on GlobalProtect (PAN 5.0.4, GP 1.2.2): 1) I have GlobalProtect currently set up with access routes to two internal subnets. My understanding is that this "Access Route" section is split tunneling, where only traffic destined for those subnets will go through the VPN, and anything else should just use my existing Internet connection, However, when I connect to the Portal/Gateway through the Windows agent, it appears to take about 10 seconds just to "Connect". Further, when I then try to browse the web, The title on the window will say "Waiting for <website>" also for about 10-15 seconds before actually pulling up the site. If I disconnect from GP, and go back to the website, it appears instantaneously. Is there something else I need to configure to immediately allow the normal Internet traffic to flow without a wait? 2) Does URL filtering apply to GlobalProtect clients? I'm guessing if so, that it falls in line with not configuring split tunneling and making sure all traffic goes through the VPN...but if I'm experiencing this performance issue with split tunneling, I'm afraid to know what it looks like with all traffic going through the GP VPN. I tried applying URL Filtering to the GP Zone, but with split tunneling defined, it didn't filter me.
... View more
04-25-2013
08:43 PM
There is no DC in the remote site...it's a small site and the MPLS private connection just allows them to connect to all of our internals AD-wise. For my PC, I'm not physically plugging directly into the Mgmt interface, I'm simply logging into the firewall through the web.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-18-2015
09:06 AM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks