About khans

Below KBs from MS for Windows 11 have helped resolve the issue for other customers. Please check which version are you running and then try to apply the patch accordingly.  KB5020387 fixed Win11 21H2 KB5018496 fixed Win11 22H2 ... View more

For the exclude video feature to work, SSL decryption is required. Please make sure that the sessions are being decrypted via the traffic logs. I also noticed that this is an HTTP2 parent session that timed out. Is this happening with HTTP2 sessions only?  If the session is being decrypted, have you tried to strip ALPN under Client Extensions under the decryption profile? This will force the session to use HTTP1.1   Please have a look at this doc: https://live.paloaltonetworks.com/t5/general-articles/troubleshoot-split-tunnel-domain-amp-applications-and-exclude/ta-p/321075 You can also check the PanGPS.log on the client-side to see if exclude video feature is being applied. Look for the line below <exclude-video-redirect>yes</exclude-video-redirect> Hope that helps!   ... View more

PEAP-MSCHAPv2 to work, a certificate will be required on the domain controller, which needs to be signed by an Internal PKI CA.   As you can see above that my DC01 has a certificate issued by my Root CA SOS.local   On the firewall side, you should have the following configuration: From the screenshot above, we can see the certificate profile applied "PEAP-Cert", which will have by signing CA and authentication protocol is selected as PEAP-MSCHAPv2 After the config above, you can create an authentication profile with the RADIUS profile above an apply it to your Portal or gateway or both.  Hope that helps!  ... View more

Hi Hakan,   Yes, you can pass SAML attributes and define them accordingly in the authentication profile in the User Attributes in SAML Messages from IdP.  But it is not required, as we can also use NameID being sent in the SAML response from IdP.      ... View more

PanOS supports SP initiated auth, where SP will be your GlobalProtect Portal and/or Gateway FQDN.  You can use Shibboleth as the IdP and import the metadata to the firewall, then set up the authentication profile, to authenticate to the Portal or gateway or both.  Please have a look at the doc below   https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/authentication/configure-saml-authentication ... View more

Please have a look at this    https://live.paloaltonetworks.com/t5/globalprotect-discussions/globalprotect-gateway-portal-and-ip-via-dhcp-public-ip/m-p/341309#M305 ... View more

https://docs.paloaltonetworks.com/globalprotect/5-1/globalprotect-app-release-notes/gp-app-release-information/globalprotect-addressed-issues.html#id17B8E400LWR GPC-11049 Fixed a rare issue where the PanGPS log file was not rotated and it caused the PanGPS.log file to consume a large amount of disk space. Please upgrade the GP client to 5.1.5. Let us know if that fixes the problem.  ... View more

Please have a look at this doc on Step 14, App option " User Switch Tunnel Rename Timeout "  https://docs.paloaltonetworks.com/globalprotect/8-1/globalprotect-admin/globalprotect-portals/define-the-globalprotect-client-authentication-configurations/customize-the-globalprotect-app.html Let me know if that helps   ... View more

Which PanOS version are you running on the firewall? As there is an issue reported in PanOS 9.0.4 with SCEP cert request showing URL encoded username i.e. ( username%40domain.com ). The issue should be resolved PanOS version 9.0.10 Let me know if that helps Thanks, Saad    ... View more

Hi, You can get a detail HIP report dump from the CLI.     This commands will give you all the users connected to the Global Protect Gateway > show global-protect-gateway current-user   Below you can see the output for a user connected to GP tunnel:  GlobalProtect Gateway: GP-Gateway (1 users) Tunnel Name : GP-Gateway-N Domain-User Name : sos\srazaque Computer : WIN10-REMOTE Primary Username : sos\srazaque Region for Config : 10.0.0.0-10.255.255.255 Source Region : 10.0.0.0-10.255.255.255 Client : Microsoft Windows 10 Enterprise Evaluation , 64-bit VPN Type : Device Level VPN Mobile ID : Client OS : Windows Private IP : 10.20.30.119 Private IPv6 : :: Public IP (connected) : 10.101.99.22 Public IPv6 : :: Client IP : 10.101.99.22 ESP : removed SSL : exist Login Time : Jun.19 14:44:23 Logout/Expiration : Jul.19 14:44:23 TTL : 2591695 Inactivity TTL : 10757 Request - Login : 2020-06-19 14:44:23.377 (1592603063377), 10.101.99.22 Request - GetConfig : 2020-06-19 14:44:23.696 (1592603063696), 10.101.99.22 Request - SSLVPNCONNECT : 2020-06-19 14:44:30.246 (1592603070246), 10.101.99.22 You can then use the following command below from the CLI and dump the hip report for the user connection. You will need the user, IP and computer name, which can be collected from the command above.  > debug user-id dump hip-report computer WIN10-REMOTE ip 10.20.30.119 user sos\srazaque Let us know if that helps! Thanks and stay safe   ... View more

Hi, You can get a detail HIP report dump from the CLI.     This command will give you all the users connected to the Global Protect Gateway > show global-protect-gateway current-user   Below you can see the output for a user connected to GP tunnel:  GlobalProtect Gateway: GP-Gateway (1 users) Tunnel Name : GP-Gateway-N Domain-User Name : sos\srazaque Computer : WIN10-REMOTE Primary Username : sos\srazaque Region for Config : 10.0.0.0-10.255.255.255 Source Region : 10.0.0.0-10.255.255.255 Client : Microsoft Windows 10 Enterprise Evaluation , 64-bit VPN Type : Device Level VPN Mobile ID : Client OS : Windows Private IP : 10.20.30.119 Private IPv6 : :: Public IP (connected) : 10.101.99.22 Public IPv6 : :: Client IP : 10.101.99.22 ESP : removed SSL : exist Login Time : Jun.19 14:44:23 Logout/Expiration : Jul.19 14:44:23 TTL : 2591695 Inactivity TTL : 10757 Request - Login : 2020-06-19 14:44:23.377 (1592603063377), 10.101.99.22 Request - GetConfig : 2020-06-19 14:44:23.696 (1592603063696), 10.101.99.22 Request - SSLVPNCONNECT : 2020-06-19 14:44:30.246 (1592603070246), 10.101.99.22 You can then use the following command below from the CLI and dump the hip report for the user connection. You will need the user, IP and computer name, which can be collected from the command above.  > debug user-id dump hip-report computer WIN10-REMOTE ip 10.20.30.119 user sos\srazaque The output will looks as follow:  <?xml version="1.0" encoding="UTF-8"?> <hip-report> <md5-sum>1964a64078fc2f95a4c5eda73f390ba</md5-sum> <user-name>srazaque</user-name> <domain>sos</domain> <host-name>WIN10-REMOTE</host-name> <host-id>43199d79-b2b3-4f66-a33d-cd0f7969970a</host-id> <ip-address>10.20.30.119</ip-address> <ipv6-address></ipv6-address> <generate-time>06/19/2020 14:48:45</generate-time> <hip-report-version>4</hip-report-version> <categories> <entry name="host-info"> <managed>unknown</managed> <serial-number>VMware-56 4d 6e e3 f0 d0 d8 41-4e ff 01 20 c2 6c 13 a6</serial-number> <client-version>5.1.3-12</client-version> <os>Microsoft Windows 10 Enterprise Evaluation , 64-bit</os> <os-vendor>Microsoft</os-vendor> <domain>SOS.local</domain> <host-name>WIN10-REMOTE</host-name> <host-id>43199d79-b2b3-4f66-a33d-cd0f7969970a</host-id> <network-interface> <entry name="{4AB91E94-3200-44F8-B57A-83F98E7EDC11}"> <description>PANGP Virtual Ethernet Adapter</description> <mac-address>02-50-41-00-00-01</mac-address> <ip-address> <entry name="10.20.30.119"/> </ip-address> </entry> <entry name="{4680DD71-B408-4045-98B1-95858E996102}"> <description>Intel(R) PRO/1000 MT Network Connection</description> <mac-address>00-0C-29-6C-13-A6</mac-address> <ip-address> <entry name="192.168.109.134"/> </ip-address> <ipv6-address> <entry name="fe80::fd6e:2175:e8b2:1520"/> </ipv6-address> </entry> <entry name="{AD04D857-4A91-11E9-A74E-806E6F6E6963}"> <description>Software Loopback Interface 1</description> <mac-address></mac-address> <ip-address> <entry name="127.0.0.1"/> </ip-address> <ipv6-address> <entry name="::1"/> </ipv6-address> </entry> </network-interface> </entry> <entry name="anti-malware"> <list> <entry> <ProductInfo> <Prod vendor="Microsoft Corporation" name="Windows Defender" version="4.18.1807.18075" defver="1.317.1735.0" engver="1.1.17100.2" datemon="6" dateday="19" dateyear="2020" prodType="3" osType="1"/> <real-time-protection>yes</real-time-protection> <last-full-scan-time>n/a</last-full-scan-time> </ProductInfo> </entry> </list> </entry> <entry name="disk-backup"> <list> <entry> <ProductInfo> <Prod vendor="Microsoft Corporation" name="Windows Backup and Restore" version="10.0.17763.1"/> <last-backup-time>n/a</last-backup-time> </ProductInfo> </entry> <entry> <ProductInfo> <Prod vendor="Microsoft Corporation" name="Windows File History" version="10.0.17763.1"/> <last-backup-time>n/a</last-backup-time> </ProductInfo> </entry> </list> </entry> <entry name="disk-encryption"> <list> <entry> <ProductInfo> <Prod vendor="Microsoft Corporation" name="BitLocker Drive Encryption" version="10.0.17763.1"/> <drives> <entry> <drive-name>C:\</drive-name> <enc-state>unencrypted</enc-state> </entry> </drives> </ProductInfo> </entry> </list> </entry> <entry name="firewall"> <list> <entry> <ProductInfo> <Prod vendor="Microsoft Corporation" name="Windows Firewall" version="10.0.17763.1"/> <is-enabled>no</is-enabled> </ProductInfo> </entry> </list> </entry> <entry name="patch-management"> <list> <entry> <ProductInfo> <Prod vendor="Microsoft Corporation" name="Windows Update Agent" version="10.0.17763.1"/> <is-enabled>yes</is-enabled> </ProductInfo> </entry> </list> <missing-patches> <entry> <title>2020-01 Update for Windows 10 Version 1809 for x64-based Systems (KB4494174)</title> <description>Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information. After you install this item, you may have to restart your computer.</description> <product>Windows 10</product> <vendor>Microsoft Corporation</vendor> <info-url></info-url> <kb-article-id>4494174</kb-article-id> <security-bulletin-id></security-bulletin-id> <severity>2</severity> <category>update</category> <is-installed>no</is-installed> </entry> <entry> <title>Security Intelligence Update for Microsoft Defender Antivirus - KB2267602 (Version 1.317.1735.0)</title> <description>Install this update to revise the files that are used to detect viruses, spyware, and other potentially unwanted software. Once you have installed this item, it cannot be removed.</description> <product>Microsoft Defender Antivirus</product> <vendor>Microsoft Corporation</vendor> <info-url></info-url> <kb-article-id>2267602</kb-article-id> <security-bulletin-id></security-bulletin-id> <severity>2</severity> <category>definition_update</category> <is-installed>no</is-installed> </entry> </missing-patches> </entry> <entry name="data-loss-prevention"> <list> </list> </entry> </categories> </hip-report> Let us know if that helps! Thanks and stay safe   ... View more

Hi,   PanOS supports SP initiated authentication for SAML, so when the user authenticates to the idP, the client will hold an SSO cookie, to authenticate all subsequent connections, hence SSO will work. But if the Cookie expires from the idP side and/or login lifetime has expired on the firewall, then the user will be initiated to authenticate again.  You can extend the login time from your idP side, as well as the firewall Login Lifetime on the gateway side. If both of these are extended, then the user should be able to authenticate for a longer period of time, but they will still be prompted to authenticate once the SSO session expires.  Currently, the GP client uses an embedded browser like IE for windows, and it can't use the SSO session from let's say Chrome browser, where the user might have already authenticated to the idp.  Starting GP client 5.2, you will have the option to set a default browser for the user i.e. Chrome and it should allow GP client to use SSO session if the user has already authenticated to the idp.  Let me know if that helps! Thanks and stay safe ... View more

Hi, If they are generated on the firewall, then they can be renewed on the firewall, by selecting the certificate and clicking renew at the bottom.  You can also create new certificates for Root, Intermediate, and server. You will need to change the server certificate in the SSL/TLS profile which is being used for the Portal and Gateway, then the Root and intermediate certificates can be added to the Portal config under Portal --> Agent --> Trusted Root CA, so they're trusted for the GP connection.  If you wanted the user browser to trust the Root and Intermediate CA certificates alongside GP client, then you can also check the box next to the certificate "Install in Local Root Certificate Store"   Users should have permission to install the Root and Intermediate CAs to their local Trust Root Certificate Store.   Let us know if that helps Thanks and stay safe! ... View more