Community Help
Community guides and FAQs
Recent Content
Azure Virtual Desktop Session Host Routing
Hi, has anyone ever set up a route table on Azure so that the route to Microsoft Login subnets goes out through Cato? When we tried doing this, to make sure our AVD users are protected by Cato, users stopped being able to connect to session hosts through the AVD FQDN (broker). I suspect that its either TLS Inspection being enabled for Microsoft Login app (has never been an issue for our laptop users), or that AVD brokering system needs Microsoft Login traffic to go through the internet instead of a private route for some reason.
Potential for abuse of the password reset link with https://cc2.catonetworks.com/forgotAdminPassword
Hi, This is Cato Lab from South Korea. Our customer raised a question. Is there any way to prevent malicious actors from repeatedly entering an email address to trigger password reset emails, potentially spamming or annoying administrators? Their concern is that someone could misuse the reset link mechanism to repeatedly send reset emails, causing inconvenience to the administrators or account owners. Does Cato have any existing protections or recommended best practices to mitigate this type of abuse? It will be really helpful if you guys know any type of protection behavior for administrators regarding using this webpage. Thanks, Best Regards, Cato Lab.
Defender for Identity - VPN Integration
Hi, We frequently get false positives from Microsoft Defender for Identity because it's unable to map the IP address Cato assigns a remote user with their laptop hostname. I guess our on prem Microsoft sensors are unaware of the Cato client range. I think the only way to fix it is to send RADIUS accounting events from Cato to the Microsoft sensor, but I don't think this can be done? https://learn.microsoft.com/en-us/defender-for-identity/vpn-integrationAnnouncement: Introducing Cato Connect's new Idea Hub
We’re excited to introduce the Idea Hub to Cato Connect! This is a space where you can share your ideas, collaborate with fellow members, and vote on suggestions that resonate with you. What is the Idea Hub? The Idea Hub is a forum for brainstorming and discussing ideas that could enhance our products, services, or overall customer experience. Explain your use-case and issue in detail so your fellow Cato Connect members can expound on the idea or even share workaround or solutions. By voting and commenting, we can surface the ideas that are truly important to our community with context and relevant use cases and examples. What happens once an idea is created? The Idea Hub is the beginning of a journey - a starting point for a discussion. Once you have submitted an idea to the Idea Hub, your fellow Cato Connect members will vote and comment on the idea. Perhaps they might even offer a solution or a workaround, or point you to another idea in the Hub about a similar problem to the one you noticed. Each comment and vote creates a more robust story for the Cato Networks Team to discuss, so don't skimp on the details. How Does It Differ from RFEs (Requests for Enhancements)? Idea Hub: A collaborative space for discussion, exploration, and voting on ideas. It’s designed to capture a wide range of feedback and innovation. RFEs: A formal process for submitting specific, detailed enhancement requests - opened by a customer's Cato Networks Representative on their behalf in certain circumstances. By keeping these two processes separate, we ensure that both can operate effectively to meet your needs. Further FAQs can be found here. Thank you for contributing to this new initiative! We can’t wait to see your creativity and insights in action. Stay SASE - Your Cato Networks Team
Disabling Connect On Boot for external user
Hi, we have activated the "Always On" policy for our users and an "on demand" rule for our external service providers. To ensure that always on is applied for our users, we have checked the "connect on boot" option, but unfortunately this option also applies to external service providers. Can our service providers override this option (registry key?) so that the CATO client doesn't launch at startup? (when I asked the CATO AI, it mentioned a key, but it doesn't seem to work). I can't see specfic configuration in user profile to override this nether. Any idea ? Thanks ! Regards
AWS can't reach Private IP - Cato Client Windows
Hi, on my PC I have the Cato Client to connect to Cato Network. We have a connection with a virtual appliance in AWS in one account. In this account there is a TGW that connect other accounts. I can' reach the private IP of AWS accounts, but all networks are routed in Cato Configuration, TGW and VPC route tables seems ok....The source/destination check is disabled for LAN interface, the client subnet 10.41.0.0/16 is associated to subnet route table, tgw route table and there is also in the other account's route tables..... But the traffic is not going well..... any suggestion ? Many thanks DarioWireless Traffic Identified as DSCP18
This is driving me up the wall and I don't see a lot of good options, aside from pester support. We're an Aruba wireless shop and we have some WMM/QoS configured. This ends up with a bunch of events where the Application/Service detected is dscp18 because Cato is picking up on the QoS value from the access point. It makes my life difficult when we try to create WAN Firewall rules based on a service on a given destination(s). Aside from de-allocating that DSCP value on my production SSID's, what can I do? Has anyone else encountered this before?
