About darren_g

Greetings   With the continued push for shorter and shorter SSL certificate validation periods coming rapidly to a head (in case you missed it - maximum SSL certificate validity is now 200 days, will go down to 100 days in March 2027, and 47 days in 2029), I'm looking for a way to automate SSL certificate renewals on my Global Protect gateways/portals.   Has anyone com up with a solution that works? Some way of automating SSL renewal - be it via something like LetsEncrypt or a regular CA's process?   Please, if you have - share your magic! Having to remember to renew portal/gateway certs every 46 days is going to suck. ... View more

hey.   I've recently been handed an increased priority on making sure that our VPN connections block clients from accessing internal resources on HIP check failure.   I know I can;t just make the tunnel disconnect - but can someone point me to a how-to or doc for configuring the firewall to disallow traffic while the connection is up if the HIP check fails?   Our HIP checks aren't complex - look for a valid anti-virus package which has up to date signatures and check for updates to a reasonable level - and they work (I can see the results), but I can't for the life of me figure out how to block access if they FAIL.   Thanks for any pointers. ... View more

Hey folks.   I had a situation today whereby one of my PA's was responding really slowly across IPSec tunnels and for Global protect clients - so once I could get onto it I started digging into the network monitor to see if I could find out if there was a link/network load issue.   I found a huge spike in traffic in the period concerned - much, much more than normal - but when I tried to check the traffic logs for matching application type, I can;t find anything which would come even close  to matching this level of load   The above shows the spike from the traffic monitor - you can see the increase plainly - and it lists as ms-ds-smbv3 - but when I go looking for that app in the traffic logs - there's minimal amounts - and none of it is in the period indicated by the network traffic monitor.   Does anyone know where I can dig to try and find out where this traffic was from/to?   Thanks ... View more

Hey folks.   I, like probably a lot of us these days, use Global protect for the major percentage of the company's workforce. I run split tunneling - internal resources go over the tunnel, anything else just uses the local internet.   Recently, I have had the need thrown at me the requirement to provide split tunneling for a set of addresses which are a dynamic DNS entry rather than  fixed IP or subnet.   This seems to be perfect for adding into the "Domains and Applications' section of the client configuration - but after researching, I find this won't work without ticking the "No Direct access to Local Network" toggle.   Can anyone tell me the implications of doing this? Is it just the local interface network which can't be accessed while Global protect is running - or does this effectively make split tunneling useless by locking out anything except the tunnel?   I can't seem to find a definitive answer - it should just be what the wording says - lockout of the local LAN used to get internet access - but I've had situations where the logical interpretation of Palo Alto speak turns out to be not so logical before!   Thanks for any input ... View more

Hey folks.   We're planning in implementing MFA for Office 365, and as part of that I want to add the Microsoft office domains into our Global protect split tunnels - since almost everyone is working from home, I want to whitelist our "corporate" IP addresses and have people who are connected from company PC's on the VPN not be bothered by MFA requests.   This is relatively easy in the configuration, but I've come across an issue which is perplexing me.   I run my personal machine on a fairly recent VPN client to check for issues before pushing it out to the main portal for users to upgrade - and when I implemented this split tunnel on the portal, it didn't work.   A colleague who is running the "production" release I have on the portal. So I downgraded tot hat version - and the split tunnelled domains work.   Does anyone know if there's something extra in the later clients which needs to be done to make this work?   Working client version - 5.0.8 Failed client version - 5.2.2   Thanks ... View more