About minow

Hey,   We have a GP configuration with 8 GP Gateways and 2 of them are acting as a GP Portal for backup. We are using SAML authentication with Azure and wanted to know how to you deploy GP with SAML authentication in large scale. Currently I have configured 3 SAML apps on Azure one for each PA device but I think it is not the right configuration since now I am getting that each SAML App's domain need to be unique and the Portal domain is for example: vpn.company.com and I need to deploy it to 2 SAML Apps. My assumptions are that because we only use SP Initiated SAML authentication meaning that the authentication process starts at the PA device I can just add all of the domains that are relevant on a single SAML App and install that Metadata file on all of the Pas. Am I right ?   ... View more

hey,   do anyone know if paloalto intends to open the plugins infrastructure so customers can add plugins to enrich panorama functions, menus UI and functions.. like other vendors have ? ... View more

hey,   i have a requirement from a customer for some users to always have the same ip when they connect to the VPN for example if the IP Pool for the GP clients is: 192.168.x.110 where x will be 10-15 depends on which GP GW you are connected to.   i have managed to configure using specific client settings for example for user A ip pool is 192.168.10.10-192.168.10.10 the problem with this is that the client use split tunnel, and if i follow this road i will need to configure all those access routes on each client settings meaning, for adding 1 network on my lan i will need to configure it on each GP GW and on each client settings can be reached up to 100 changes for 1 network subnet.   i have seen the registry key for the reserved ip address but what happen if the user connect to the PA on another site in which this ip is not relevant.   i have also seen the "retrieve framed ip address attribute from authentication server" but cannot find documentation on how it works. i think it might be a solution. clients authenticating with SAML with the GP GW, so if the framed ip will be list of addresses and each GP GW will choose the i according to the "authentication server ip pool"   thanks ... View more

Hey,    can some one put some light on the authentication & authorization of the PA to Panoram ommunication channel?   from what i know is that on panorama side we must have the SN for initial communication. what happens from the point that the PA first contact panorama ?  what happens on regular basics on the communication between the PA and the panorama? i know that the traffic is encrypted but with what certiciate and private keys ? is there some kind of PKI infrastructure between the panorama and the PA for that communication? is there any Keys handshake between the Panorama and PA on their first contact? can i do certificate Pinning on the PA side to prevent man in the middle attack since most of my deployments the PA communicates with panorama throught the internet sine the S2S configuration is controlled from panorama?  is there any kind of "client authentication" on the SSL channel?   an engineer once told me that there is some kind of "default cetificate" that is used for this channel so: 1) is it comes with the installation?  2) all customers have the same certificate with the same keys? 3) is it generated uppon panorama installation?   i will appriciate any information and data regarding this   thanks ... View more

hey   i am configuring two factor authentication, 1) portal with certificate 2) gateway with OTP   i have noticed that i can authenticate to the portal with user "A" and than on the gateay i succesfully authenticated with the OTP of user B (username & password)   the question is if we can enforce the authentication to teh gateway will be with the same username as we have authenticated to the portal ?    if user A the laptop got stolen and for user B the phone with the OTP got stolen an attacker can gain access to the VPN   thanks ... View more