topic Re: global protect timeout increase through Panorama CLI in GlobalProtect Discussions

global protect timeout increase through Panorama CLI

Deepak25 — Mon, 03 Jan 2022 13:25:41 GMT

We are managing the firewall through Panorama. We want to increase the global protect timeout as mentioned in below article.

https://knowledgebase.paloaltonetworks.com/kCSArticleDetail?id=kA10g000000PNma

Can we make the changes directly through local firewall CLI ?

Re: global protect timeout increase through Panorama CLI

PavelK — Tue, 04 Jan 2022 00:00:13 GMT

Thank you for the post @Deepak25

If current Global Protect configuration is pushed by Template you will not be able to make this change locally on Firewall unless you override it: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cld5CAC

I would suggest to run this with override: override deviceconfig setting global-protect timeout <Timeout value>

Then you should be able to commit it locally on Firewall.

Kind Regards

Pavel

Re: global protect timeout increase through Panorama CLI

Deepak25 — Thu, 06 Jan 2022 08:38:41 GMT

Overriding template for small change is not looks proper. What is the command to increase timeout via panorama?

Re: global protect timeout increase through Panorama CLI

PavelK — Thu, 06 Jan 2022 09:35:48 GMT

Thank you for response @Deepak25

I see, I think I misunderstood when I was replying you.

To change that value via Panorama, you can use below command:

set template <name of the template> config deviceconfig setting global-protect timeout <time out value>

Kind Regards

Pavel

Re: global protect timeout increase through Panorama CLI

Deepak25 — Fri, 07 Jan 2022 21:38:10 GMT

@PavelKI have set GP auth timeout via panorama by running command : set template <name of the template> config deviceconfig setting global-protect timeout <time out value>

But when I check #show deviceconfig setting global-protect in firewall CLI , changed value is not showing.

Same command if try in Panorama , I can see the changed value.

Is it expected ?

Re: global protect timeout increase through Panorama CLI

PavelK — Fri, 07 Jan 2022 22:56:24 GMT

Thank you for reply @Deepak25

This is not expected. Could you please make sure that Template you made a change to is bound to the Template Stack where the target Firewall you want to make change is associated to? Also, could you confirm by going to: Panorama > Managed Devices > Summary > [Navigate to target Firewall] > Check status of: "Template Last Commit State" to make sure this has been pushed without any error.

Kind Regards

Pavel

Re: global protect timeout increase through Panorama CLI

Deepak25 — Mon, 10 Jan 2022 17:05:11 GMT

Running the command on firewall resolved the issue. I can see increased timeout value on firewall and radius authentication going to secondary radius server when primary radius server is unreachable.