About ToddJohnsen

ToddJohnsen · ‎07-02-2019

The problem with that is that it assumes that site 1.1.1.0 is available. Secondary sites would still be routing there even if it went down.

ToddJohnsen · ‎06-19-2019

I have been using small(ish) static routing tables until now. I have 2 PA-3020 in HA mode that control the internet and new offsite datacenter. At a second location 15 miles away, I will have a backup link to that datacenter. A third 3020 is in place to handle the connection. My plan is to install OSPF on the juniper gear controlling the internal network. How do I advertise the two links to this new datacenter to the OSFP area from the Palo Alto's though? I'm not very familiar with BGP but even a general idea/best practice would be helpful for me to start reading up on. Rough map attached. Ultimate goal: have access to the datacenter regardless if one link goes down without manual changes from me.

ToddJohnsen · ‎08-14-2018

So, turns out that Thawte and a few others really do require a full csr for renewal. My mistake was creating the cert on the Palo Alto itself. Long story short, don't create an external cert that you plan to renew on the Palo Alto itself. I did find the original csr and did use it to create a new cert. Imported it over the old with the exact same name, but the commit failed due to key mismatch. = Don't create external certificates on the Palo Alto = I have installed openssl on a vm in order to create the cert from now on. I also documented the crap out of it since I will only do this every two years. Again, Don't create external certificates on the Palo Alto. In case you missed it, this was ridiculously over complicated. I finally found something to complain about with my Palo Alto. This would also explain why there is no documentation on this process at all.

ToddJohnsen · ‎08-07-2018

Someone over in Contracts is doing the process. I feel like they only have ever done new certs so i am pushing back. Just needed to make sure I am not crazy. Once I figure it out I will post back to confirm.

ToddJohnsen · ‎08-07-2018

Are you using the agent or agentless setup? I upgraded to version 8 not too long ago and ran into problems with the agentless setup. My problem was that the logged in user suddenly became unknown per the palo alto. Turns out I had two problems. 1. The default domain contorller policy for logins was only logging failure, not success. I changed this in the default domain controllers gpo. 2. I use the WMI Authentication for the User-ID Setup. The AD account used requires special permissions to work. My missing piece for that was that the account needed to be a member of the Remote Desktop User group on computer without local admin rights. I can't recall the special permission needed exactly, but that was the easy way to solve it.

ToddJohnsen · ‎08-07-2018

I can't for the life of me figure out the process to renew a certificate issued from an external CA. We have a cert purchased from Thawte for our Global Protect gateway. It will expire shortly and Thawte wants a csr file for the renewal. Selecting renew in the Certificates tab only allows me to select how many days, which is not helpful. I have gone through the online docs and find many options for a new cert, but nothing on the process to renew. Seems like I am missing something really simple.

ToddJohnsen · ‎11-19-2014

Page 155 if anyone else is looking.

ToddJohnsen · ‎11-19-2014

Finally traced the problem to user credentials. Each link is being passed without prompting for the network credentials (Active Directory in our case). If we open a network share prior to running the links, we get the AD challenge box. Once we login the links will start working. Not sure if this ever helps anyone but at least we know why now.

ToddJohnsen · ‎11-19-2014

This may have been posted before but I am not finding the answer with my searches. I have a single Global Protect Gateway setup with a split tunnel configuration. I found a tech note for how to setup both a split and full tunnel on the same gateway but I was wondering if we could force the client computer to connect prior to the windows login screen in the full tunnel. I want the network credentials for the local computer to not be cached for off-site computers. I can't seem to find an answer to that. I thought I did this years ago with a different product but I would not swear to it right now. Anyone have any ideas? Thanks for reading, Todd

ToddJohnsen · ‎07-21-2014

Same error. The idea was to open a network share or start a RDP session to an old Terminal Server (2003) from the two links. RDP had to be a link as the Welcome page info I found, said only html code is supported. The html page works fine if I launch it locally on my system. It just will not work from the Welcome Page display.

ToddJohnsen · ‎07-18-2014

I have been testing out using the Welcome page for the Global Protect client as a landing page for network links. The old appliance had a user friendly set of links for the average user. Right now the basic web links for email or www pages work fine. I have two types of links that don't seem to work though. Any ideas? Code: <a href="file://///fs/share$/ts1.lnk">Terminal Server 1</a><br> <form action="file://///fs/share$" target="_blank"> <input type="submit" value="Network Drive"> </form> Both will launch a black IE screen (even if IE is not the default browser) and then give an error dialog box. -Server Busy- "This action cannot be completed because the "" program is nto responding. Choose "Switch To" and correct the problem. Clickable boxes are "Switch To..." and "Retry". The Cancle box is greyed out. I can click either box without any impact, the dialog box just comes backup until I end task out. The code works fine normally but not when launched in the Welcome Page from GlobalProtect client. Anyone seen this or better yet, conquered this? Thanks, Todd

ToddJohnsen · ‎04-03-2014

Pardon if this is a repost but I am new and could not find anything similar. Right now our 3020 unit seems to only be getting 4 or 5 days worth of log information before it fills up. We would like to have access for the last 30 days if possible. Is there a way to backup the monitor logs and then be able to search them later if called upon? Oh, yeah, there is zero budget for this. I do have an automated daily backup of the running-config.xml via scp cobbled together at the moment. Not sure if that could be useful. Thanks, Todd

ToddJohnsen · ‎01-07-2014

Thanks SLawek, I finally figured it out with your help. I ran the Threats report and found all the Suspicious DNS Query results I had been unable to find before. Each one has a different ID code that I was able to search for in the Threat log as you describe with great success. Looks like I should be able to trace this after all. -Todd

ToddJohnsen · ‎01-03-2014

I got a notice from my ISP that we have a Conficker infected system (downadup) but I am coming up with nothing when I try to find it. The less than helpful info I recieve is the first octet of the target IP (38) and source port 61494, which map to hundreds of system. I also have a destination port of 80, again very helpful. The firewall is NATing for about 2000 systems. Has anyone used their panos box to track a system before and if so what did you do? We have ESET deployed for anti-virus and it is not showing anything right now. We could be missing a system though. I am still fairly new to my PA-3020 box so use small words please. I have been using the threat log and tried the pre-built reports. The Monitor Logs are amazing but I can't seem to narrow the search enough to find the problem. I only have the URL filter and threat prevention license on 5.0.9 Thanks, Todd

ToddJohnsen · ‎12-17-2013

Thanks EdwinD, We had some embedded videos that simply would not work until I found your post. We are only using the URL filter, not application based. The only difference I had was that I had to add the following two links as well: a.vimeocdn.com/p/2.1.18/js/player.js a.vimeocdn.com/p/2.1.18/css/player.css I used the Monitor to find the mp4 link which is a bit of a pain but at least it worked. So far I have been able to get away with just the *.youtube.com/watch?v=8Ur3tVeAqXE style links, except for when using embedded links one time. I had to add the following link as well, youtu.be/8Ur3tVeAqXE to make it work then. I am on 5.0.9 at the moment if that helps someone later. Thanks.

Member Since	‎10-04-2013 08:34 AM
Date Last Visited	‎01-26-2026 11:57 AM
Posts	15
Total Likes Received	2

Online Status	Offline
Date Last Visited	‎01-26-2026 11:57 AM

About ToddJohnsen

Re: Dynamic Routing offsite

Dynamic Routing offsite

Re: External Certificate Renewal

Re: External Certificate Renewal

Re: Authenticated User-ID with GlobalProtect for Internal Network Segmentation

External Certificate Renewal

Re: Global Protect before login

Re: GlobalProtect Welcome Page for network links

Global Protect before login

Re: GlobalProtect Welcome Page for network links

Re: Global Protect before login

Re: Dynamic Routing offsite

Dynamic Routing offsite

Re: External Certificate Renewal

Re: External Certificate Renewal

Re: Authenticated User-ID with GlobalProtect for Internal Network Segmentation

External Certificate Renewal

Re: Global Protect before login

Re: GlobalProtect Welcome Page for network links

Global Protect before login

Re: GlobalProtect Welcome Page for network links

GlobalProtect Welcome Page for network links

Internet logs, backup and review

Re: Tracking an infected computer

Tracking an infected computer

Re: Allow Vimeo From Specific Website

Unlock your full community experience!

About ToddJohnsen