About johan.boeckx

johan.boeckx · ‎04-10-2022

We have the same problem here. We have Panos 10.0.8. By moving from 15 minutes to real time, the error "Wildfire info failed" disappeared and the error 'WFRTSIG: Unknown error" and "Failed to connect to wildfire-realtime cloud, retry after 30 seconds" now and then.

johan.boeckx · ‎03-12-2021

I am having the same issue. We want to upgrade version 9.1.8 and have a working saml implementation for Globalprotect under 9.0.x . Since now signing and validate "identity provider certificate" is required, signing messages seem obligatory. When I enable the profile with ipc enabled in gateway it works. When I enable it in portal, it doesnt work under version 9.0.x. When I only sign after upgrade under panos 9.1.8, I notice that the translation from UPN (user principal name / emailadresses) to Ad user doesnt work anymore, causing all traffic blocked. I suppose it has something to do with the new saml implementation starting panos 9.1.3 . Did something change on UPN translation on panos 9.1.X ? The error i get when trying to enable identity provider certificate is : Failed to validate the signature in IdP certificate "crt.AzureaD-SAML.shared" of entity Id "https://sts.windows.net/xxx"

johan.boeckx · ‎08-06-2016

Hi all, I have the following problem. We have an ssl certificate (public ca) and this renews end of this month. We use ssl.domain.xx as gateway. Since we have to renew our certificate I ordered Networksolutions certificate and installed this within the certificates 'device/certificates' with the complete chain, according the normal procedure. Root certificate and intermediaire certificate give ca indicates. All well till here. Now I try to configure the portal configuration for globalprotect, where I have to provide the agent configuration. I install the root certificate under root-ca which goes well , but when I add the intermediairy certificates trusted by the root certificates, it gives the error "client-config is invalid" and "root-ca is invalid. The only thing I can imagine, is that those are not indicated under "Default Trusted Certificate Authorities". It concerns the following ca's : OV_NetworkSolutionsOVServerCA2 and OV_USERTrustRSACertificationAuthority. Anybody has an idea why those errors appear and how this can be fixed ?

johan.boeckx · ‎06-02-2015

Thanks Hyadavall, but I tried that. What I did was creating custom url_categorie, and put here all the *.microsoft sites in it. This category I applied in the rule and added as url category in the policy. I don't think I can add a customer url category as service, like you said. Problem is that not only the traffic to the microsoft sites seems to be allowed, but also all the traffic going to untrust, which has no url category, and translated as any. 23.101.14.229 is ip of a newspaper. greetz, Johan

johan.boeckx · ‎05-25-2015

Hi all, I am trying to get lync2013 working, and more specifically Skype for Business, successor of Lync. I have Lync 2013 completely working, but I would like to permit all the wildcards permitted through url filtering, linked to a number of applications as Stun, ssl, mslync,... After this rule , there are also other url filtering rules, for example for all other users, going to internet. The list I am talking about is : *.microsoftonline.com *.microsoftonline-p.com *.onmicrosoft.com *.sharepoint.com *.outlook.com *.lync.com *.verisign.com *.verisign.net *.public-trust.com sa.symcb.com I tried with security profile, with an allowed url_categorie, for ex. 'Microsoft permitted sites' with the wildcards in, but problem is that in that case, I have to block all categories, otherwise all categories are permitted. Blocking is also no option, since then users can only go to the defined sites and nothing else. Anybody an idea ? thanks

johan.boeckx · ‎11-16-2014

I tried this, but didnt gave any result. I digged a bit deeper and read number of Palo alto docs regarding flow_tcp_non_syn_drop, which I had a lot. This is related to assymetric routing. Strange is that we dont have assymetric routing, but since this webside is in the cloud, the problem can have originated on the internet. Anyway, I disabled the TCP - reject non-SYN first packet: from true to false. Now,a number of applications work on this cloud based site, only not the citrix related, tunneled through ssl.Nothing is blocked through policies.

johan.boeckx · ‎11-15-2014

HI, Thanks for the answer. I checked the session based on the source as on the destination. Both there were no active sessions admin@FW01CO(active)> show session all filter state discard source 10.104.0.8 No Active Sessions admin@FW01CO(active)> show session all filter state discard source 10.104.0.8 No Active Sessions admin@FW01CO(active)> show session all filter state discard destination 193.109.234.40 No Active Sessions admin@FW01CO(active)> show session all filter state discard destination 193.109.234.43 No Active Sessions

johan.boeckx · ‎11-15-2014

HI all, We have a cluster of 2xPA3050, for protection to untrusted zone. Last week we enabled the trial license for url_filtering. Since that moment we have met a special problem. We use a citrix application over ssl in the cloud. This citrix server is perfectly reachable, but after the authentication, the application seems to hang. We disabled all rules referring to url_filter categories, so there is no reference in the policy to url-filter. Nevertheless, with the license enabled, the citrix application doesn't work. There is no reference in the monitor tab/logs that something is dropped. By doing a packet capture, we only see an rst tcp reset from the other side, but nothing seems to be dropped or logged. Anybody knows how I can troubleshoot this ? Is there a possibility that with activating the pan-db database in the licenses, without activating any rules, that there is an interception on ssl traffic ? We have panos6.1, url_filtering, also global protect is enabled. Ssl decription is not enabled. Thanks and greetz, Johan

johan.boeckx · ‎10-11-2014

Doesnt work I suppose it is not the cn of the name you give in the PA. I tried to give the gateway name the same as the name of the certificate . Still the same result greetz, Johan

johan.boeckx · ‎10-11-2014

That was correct answer. I changed the gateway address now tothe url, which makes part of the wildcard certficate. It works now. What troubles me a bit, is that I still see in the logging of the gp client : " (T92424) 10/11/14 16:40:16:525 Info ( 107): Failed to verify server cert. Result is self signed certificate in certificate chain (T92424) 10/11/14 16:40:16:525 Info ( 126): SSL_get_verify_result() failed: (null) Any idea about this ? greetz, Johan

johan.boeckx · ‎10-11-2014

Hi all, We experiencing a problem with the new version of Global Protect 2.1.We have PA 6.0.3. We use a 3th party as authenticaton manager. The problem appears with the certificate of the gateway : we use forthis certificate a wildcard signed certificate. All the gp clients upgraded to this version receive the following error : Gateway external_gateway_2: Server certificate verification failed. With version 2.0.x , this problem didnt arrive. This is no problem with all clients (laptops, androids, ...), butthis has become problem with ios-devices, since they upgraded automically from appstore, since appstore upgraded their version to 2.1. Anybody knows if this is a general problem.Has the new globalprotect client a requirement of > panos 6.0.3 ? Error message : Gateway external_gateway_2: Server certificate verification failed from logs tested with 64 bit laptop win7 : (T99064) 10/11/14 13:32:30:934 Error(2147): Failed to verify server certificate of gateway xxxxxxxxxxxx. (T99064) 10/11/14 13:32:30:934 Error(1520): Failed to retrieve info for gateway xxxxxxxxx. (T99064) 10/11/14 13:32:30:934 Error(2350): NetworkDiscoverThread: failed to discover external network. greetz

johan.boeckx · ‎06-14-2014

Thanks Panos. That was what I looked for. Is there somewhere some manual for the syntax ? Greetz, johan

johan.boeckx · ‎06-14-2014

Hi Hulk, Thanks for your answer, but was not exactly what I meant. The tab 'highlight' is more the used rules since the last reboot, this means enabled and disabled rules. What I try to do is to filter on disabled rules. The reason is that I am busy with a migration from Checkpoint to Palo Alto and have some 200 rules : all the one that I dont need anymore, I disable, but I dont them removed. I try to have the effect that I don't see them anymore in the policy tab within the webui. thanks and greetz

johan.boeckx · ‎06-14-2014

Hi, I am quite new with Palo Alto and I try to filter disabled rules, so that I only see the enabled rules. I know that a lot of syntax can be found in the monitoring tab, but since enabled/disabled rules are not in it, I cannot find. It is on the Palo alto itself, not Panorama.

Member Since	‎04-11-2014 01:06 PM
Date Last Visited	‎04-10-2022 06:54 PM
Posts	15
Total Likes Received	1

Online Status	Offline
Date Last Visited	‎04-10-2022 06:54 PM

About johan.boeckx

Re: Wildfire info failed

Re: Unable to Authenticate to GP using SAML

Problem renewing ssl certificates with global protect portal

Re: Problems with ms lync / url filtering

Problems with ms lync / url filtering

Re: url_filtering problem

Re: url_filtering problem

url_filtering problem

Re: Since upgrade globalprotect 2.1 certificate problems

Re: Since upgrade globalprotect 2.1 certificate problems

Re: Since upgrade globalprotect 2.1 certificate problems

Re: Wildfire info failed

Re: Unable to Authenticate to GP using SAML

Problem renewing ssl certificates with global protect portal

Re: Problems with ms lync / url filtering

Problems with ms lync / url filtering

Re: url_filtering problem

Re: url_filtering problem

url_filtering problem

Re: Since upgrade globalprotect 2.1 certificate problems

Re: Since upgrade globalprotect 2.1 certificate problems

Since upgrade globalprotect 2.1 certificate problems

Re: How can I filter disabled rules in the 'policies'-tab

Re: How can I filter disabled rules in the 'policies'-tab

How can I filter disabled rules in the 'policies'-tab

Unlock your full community experience!

About johan.boeckx