install cert on IIS web server

 For IIS I needed the .pfx file which is a bundle of certs and private key in one file with a password attached.

I used the digit cert tool.

Downloaded cert files from CA vendor

Imported files into digi cert tool

Ran test key 

Exported as .pfx including the private key

Moved .pfx file to the IIS server

Double click to import

enter password

Mark as exportable in case we need to export in the future

Open IIS

Expand sites

Default Web site

On the right -> Edit site -> Bindings

Add

https 

Fill in hostname: sub.domain.com

In bottom section select the cert, we should see the cert that has been imported.

You may need to restart IIS

meraki routing

Meraki when you add an address to the HQ VPN encryption domain it forces all remote sites to route that traffic to HQ

if you only wanted to do it, for one site you can use static routing on the remote side

I was using the uplink IP address in HQ as the next hop but that is incorrect

routing

1 HQ route

manual 

mx ip = 192.168.128.1/24

upilink any

group non

vpn mode enabled

install wildcard cert on palo alto firewall

Global protect portal and gateway should be setup

Get customer to get DNS record created eg globalprotect.domain.com

Point the record at the global portect portal IP (Network -> Global Protect -> Portals)

Download the wildcard cert and root/chain cert from the cert vendor (.crt format). The windows .p7b format is no good. The chain bundle cert usually publicly available. The wildcard will need to be downloaded via a login may need to get it from the customer.

Install wildcard cert on palo alto firewall

Global protect portal and gateway should be setup

Get customer to get DNS record created eg globalprotect.domain.com

Point the record at the global portect portal IP (Network -> Global Protect -> Portals)

Download the wildcard cert and root/chain cert from the cert vendor (.crt format). The windows .p7b format is no good. The chain bundle cert usually publicly available. The wildcard will need to be downloaded via a login may need to get it from the customer. Example vendor chain location:

https://certs.godaddy.com/repository

Import vendor root/chain cert bundle

Device -> certificate management -> certificates 

Click import 

Give name eg "vendor-ca-root-chain-bundle"

Select the bundle file "bundle-g2.crt"

Leave everything else and click ok

Import wildcard cert

This can be imported in a few methods (.crt) (.pfx) if its PFX you will need to include the password

Certs should look like this

 

Create SSL/TLS profile

Device -> Certificate Management -> SSL/TLS Service Profile

Name "SSL-TLS-PROFILE"

Min version: TLSv1.2

Max version: Max

Attach SSL/TLS profile to global protect portal and GW

Network -> GlobalProtect -> Portals 

Click the GP_Portal

Authentication tab 

Under server authenticaiton / SSL/TLS service profile

Select your "SSL-TLS-PROFILE" from the drop down

Configure the URL used for portal/gateway in the portal

Network -> GlobalProtect -> Portals

Click the GP_Portal

Agent 

Add the CA root and chain cert (optional to tick install in root cert store)

 

Now click on GP_Agent_Config -> External

You will need a DNS -> pub IP record setup with the external DNS vendor

Fill in the DNS name for the Gateway

 

Add the SSL-TLS profile to the gateway as well

Network -> GlobalProtect -> Gateways

Click the GP_Gateway

Authentication tab

Under server authenticaiton / SSL/TLS service profile

Select your "SSL-TLS-PROFILE" from the drop down

Change IP to URL

Go Portal - GP settings - Agent - Agent config - External

Change external gateway IP to URL

Testing

Do not forget to commit your changes

You may need to restart the GP client

Test web browse to https://globalprotect.domain.com

Test connecting the GP client to globalprotect.domain.com

Cisco umbrella VA backoff

When the umbrella roaming client detects a VA on the LAN with it by default it will switch itself off and let the VA discover identity. Umbrella support said we can change this option.

https://support.umbrella.com/hc/en-us/articles/230901168#VirtualAppliance

packet capture on cisco ASA firewall with trace

Good capture option here for ASA

You can do a show trace on it and it goes though it like a packet tracer

capture capout2 type raw-data trace detail interface OUTSIDE include-decrypted match ip host 192.168.10.50 host 8.8.4.4

show capture capout2 trace detail packet-number 1

find loop on cisco switch

Old school method for old/cheap switches with no CLI.

Front LEDs can provide indications like all on solid or call flashing in unison but not reliable across switch models.

WIth this method you need to know where all your trunk/uplinks are. Start by unplugging all trunks does the traffic stop ? If yes then traffic is probably coming from another switch start plugging back in trunks until the loop starts again. You should be able to find the switch and repeat the process there.

If the traffic does not stop then its coming from a server/user port or an unknown trunk. Start disconnecting each cable one by one until the traffic stops.

Cisco switch CLI method:

Can check ram and CPU usage is usually a good indicator or a loop.

Look at the 5 minute input rate packets/sec for the interfaces 

Looking for high values like 28458 packets/sec

show interfaces | in Gigabit|rate

You may have a mix of interfaces

show interfaces | i TwoGig|TenGig|TwentyGig|rate

show cdp neighbors | in "same-switch-name"

Wireshark

You can also take a Wireshark capture and look for high levels of arp/broadcast. Also look out for DHCP requests flying around again and again 

Other Administrators are holding device wide commit locks on palo alto firewall

 I couldn't make changes. It said my user had the lock but still couldn't make the changes.

Check you are not on the passive firewall.

Clicked the padlock in top right that had a (3) beside it. I could clicked  on all users and clicked "remove lock"

Others reported having to use the CLI

show commit-locks

request commit-lock remove