About jambulo

jambulo · ‎02-09-2024

Over the past couple of weeks we have been getting more and more support tickets stating that our users can't connect to GlobalProtect VPN. The one common thread they have is they all have T-Mobile Home Internet. Has anyone else noticed this? Is there a fix or workaround? Thank you.

jambulo · ‎02-08-2023

Anyone have a solution to this problem? I'm seeing the exact same thing. I verified via PCAP that users are getting redirected to the Captive Portal unencrypted over port 6080. I can browse to the Captive Portal over port 6082 and I get a valid TLS connection with the correct server certificate.

jambulo · ‎12-19-2022

I'm having trouble figuring out what expression to use(in a Custom URL Category) to match any variation of HTTP requests for an entire website. For example, I want a single expression to be able to match/block/permit the following HTTP requests... example.com/ example.com/path abc.example.com/ abc.example.com/path xyz.abc.example.com/ xyc.abc.example.com/path So far I've only been able to match all of the above by using 2 expressions in the Custom URL Category... EXAMPLE.COM/ - This will permit example.com/ and any path after it. Will not permit any subdomains. *.EXAMPLE.COM/ - Will permit abc.example.com/ and any path after it. Does anyone know of a way to match an entire website using a single expression?

jambulo · ‎05-16-2022

I'm trying to set up an Internal Gateway for GlobalProtect, and am finding that GP does not connect to the Internal Gateway if the Connect Method is set to "On-demand". It works just fine if I set it to "Always-on". Is this the way it's supposed to work or am I missing something?

jambulo · ‎08-04-2021

We are testing SSL decryption and are finding that Macs are getting a certificate warning page when visiting https://www.apple.com. The warning says "This website may be impersonating "www.apple.com" to steal your personal or financial information". These Macs do trust our Root CA, so it's not that. I put "www.apple.com" in the SSL Decryption Exclusion list and that resolved it. Anyone know what is causing this warning? Is it certificate pinning? A couple of our Mac testers also reported that they could not download the Big Sur update over GlobalProtect(www.apple.com was not yet in the exclusion list). Does the Palo need www.apple.com(and maybe others) added to the SSL Decryption Exclusion list in order for Mac updates to work?

jambulo · ‎11-27-2020

We recently ran into a bug where the Palo was not logging some traffic if it hit a rule that did not have Zones defined. Does your security rule happen to not have Zones defined?

jambulo · ‎04-06-2020

Has anyone found a fix for this? I can confirm, with full tunnel VPN MS Office thinks there is no internet. With split tunnel VPN MS Office can see that there is an internet connection.

jambulo · ‎02-14-2020

Not sure if this is still being updated/supported, but you can try the Pan(w)achrome Chrome plugin.

jambulo · ‎02-14-2020

In the last few days we've been getting a ton of FP's. None of these files are related in any way, but one commonality we did find was Wildfire was keying on these 2 things: 1) Http request without User-Agent 2) HTTP GET requests to x.x.x.x/wpad.dat (x.x.x.x being the same IP every time). Also, our WF500 appliance is reporting all of these FP's. If we upload the same file to the WF cloud, the files come back as benign. I have a ticket open with support and they have escalated it to engineering.

jambulo · ‎08-09-2019

I have a similar issue with GlobalProtect 5.0.3 and Duo MFA. Not sure if everyone is aware how Duo MFA works with GlobalProtect, but instead of enter in a one-time passcode, you can enter in the number "1" and Duo will send a push notification to your mobile device. Well, I entered in "1", never got the push notification(not sure why), but this caused the GlobalProtect client to get stuck at "Still Working...". I waited 25 minutes and the client never timed out, it just kept trying.

jambulo · ‎02-28-2019

From what I understand, Palo Alto has templates on Github you can use to deploy the PA in an existing Azure environment(without using the marketplace). https://docs.paloaltonetworks.com/vm-series/7-1/vm-series-deployment/set-up-the-vm-series-firewall-in-azure/use-the-arm-template-to-deploy-the-vm-series-firewall.html#

jambulo · ‎02-28-2019

You can create a Custom URL Category with an entry of "*.*" (not including the quotes). This will log URL's without the license. It just will not(obviously) categorize them.

jambulo · ‎08-21-2018

Are the subnets equal to each other? Not sure what you mean. Will you generally allow traffic between the subnets? Generally will not allow traffic between subnets. Are the subnets contain different group of servers? (One subnet for linux and one for windows for example) Subnets can contain different types of servers, but mainly are separated by the functions that the servers provide. Do you plan to configure generic zone firewallrules or do you configure specific rules for each server? Specific rules for each server.

jambulo · ‎08-17-2018

If you have a DMZ behind the Palo and it contains multiple VLANs or sub-interfaces, would you create multiple Zones(one for each VLAN)? Or create a single "DMZ" zone and apply that to all of the VLANs?

jambulo · ‎07-30-2018

You can do this with a single Portal. You could put the Portal on a loopback interface on the Palo(with a private IP). Internal users will access the Portal via internal IP, external users would NAT to the internal IP.

Member Since	‎11-08-2010 11:51 AM
Date Last Visited	‎11-08-2024 07:46 AM
Posts	114
Total Likes Received	25

Online Status	Offline
Date Last Visited	‎11-08-2024 07:46 AM

About jambulo

GlobalProtect VPN not working on T-Mobile Home Internet

Re: Captive portal authentication over TLS

What expression to use to block/permit an entire website?

GlobalProtect Internal Gateway and On-Demand

SSL Decryption and www.apple.com

Re: Traffic logs not shown the recent logs for particular source IP

Re: Global protect and Outlook 2016

Re: Measure CPS practically

Re: Wildfire False positivs ... more than usual

Re: Global Protect 5.0.2 - working deployments/configurations, open issues and everything else

What is the Agent User Override Key used for in GlobalProtect

Re: URL logs without URL Filtering license

Re: GlobalProtect with MFA/Dual Authentication

Re: How to find source of high open sessions and/or throughput

Re: Using PA-200 for home internet router?

GlobalProtect VPN not working on T-Mobile Home Internet

Re: Captive portal authentication over TLS

What expression to use to block/permit an entire website?

GlobalProtect Internal Gateway and On-Demand

SSL Decryption and www.apple.com

Re: Traffic logs not shown the recent logs for particular source IP

Re: Global protect and Outlook 2016

Re: Measure CPS practically

Re: Wildfire False positivs ... more than usual

Re: Global Protect 5.0.2 - working deployments/configurations, open issues and everything else

Re: PA VM-Series on VM in Azure

Re: URL logs without URL Filtering license

Re: DMZ with multiple VLANs, multiple Zones?

DMZ with multiple VLANs, multiple Zones?

Re: Mixed Internal and External GlobalProtect

Unlock your full community experience!

About jambulo