topic Re: GlobalProtect, Working from Home, Prisma Access and Covid-19 in General Topics

GlobalProtect, Working from Home, Prisma Access and Covid-19

jdelio — Thu, 19 Mar 2020 22:17:47 GMT

To all,

Just wanted to post a message about the Hot Topic right now, which is Covid-19.

With all of this going around, everybody's health and safely is the utmost concern. Keeping your hands clean, washing your hands (A LOT), using hand sanitizers, and stop touching your face (I see you doing it now).

One of the things that is happening all over the place is telecommuting. Just like being safe in the real world, a VPN is a necessity when doing your work online. Palo Alto Networks has a couple of products that can help keep you secure online, which are GlobalProtect and Prisma Access.

GlobalProtect is the built-in VPN solution for our Strata (firewall) suite.

Prisma Access is our globally distributed cloud service that can automatically scale when your need increases.

One of the advantages of using Prisma Access is that you do not need to deploy any new hardware to expand your capacity.

For GlobalProtect, our sales staff is available is to help your need for more hardware capacity.

For Prisma Access, we are offering free accelerated deployment and on-boarding of remote users.

Also, for any existing Prisma Access customers, we will be giving additional capacity to address increased usage at no additional cost for 90 days.

This is meant as a reminder for everyone that we have products to keep you secure.

Please send an email if you have any questions about increasing capacity to the following address:

rapid-response@paloaltonetworks.com

More Information:

Palo Alto Networks CEO, Nikesh Arora has put out a blog about this subject here:

Securely Connect and Scale Remote Workforces

For a list of Configuration and Troubleshooting articles, please see the GlobalProtect Resource List here:

GlobalProtect Resource List on Configuring and Troubleshooting

For any questions about licensing, please review GlobalProtect License requirements here:

GlobalProtect Licensing

Please check my Blog about this with more information, links and even videos here:

GlobalProtect and Prisma Access during COVID-19

Re: GlobalProtect, Working from Home (WFH) Prisma Access and Covid-19 (Coronavirus)

Sokchen — Fri, 13 Mar 2020 03:54:25 GMT

Dear Jdelio,

Do you have any discount for Global Protect?

Thanks

Best regard,

Sokchen

Re: GlobalProtect, Working from Home (WFH) Prisma Access and Covid-19 (Coronavirus)

jdelio — Wed, 26 May 2021 21:51:04 GMT

Dear @Sokchen,

One of the best parts about GlobalProtect is that the core license to run the product is FREE. The only time you need the license is when:

Using HIP
Using iOS or Android mobile application

Otherwise you will only be limited to the hardware limitations of your device.

Which are listed in the spec sheets..

https://www.paloaltonetworks.com/network-security/pa-series

Re: GlobalProtect, Working from Home (WFH) Prisma Access and Covid-19 (Coronavirus)

gesqueda — Mon, 16 Mar 2020 22:16:34 GMT

Is there a way to get throughput statistic of GP Usage.

Since we are quickly adding more remote users through global protect we need a way to monitor throughput and performance on the firewall.

So far all I have been able to find is ways to track the AP but it is not representative of throughput

Re: GlobalProtect, Working from Home (WFH) Prisma Access and Covid-19 (Coronavirus)

jdelio — Thu, 19 Mar 2020 18:07:10 GMT

@gesqueda

Are you wanting performance numbers? or are you just wanting to show the number of users?

Inside of this KB about troubleshooting GlobalProtect, it shows many things including the commands below to show the usage:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClkBCAS

Command	Description
current-satellite	Show current GlobalProtect gateway satellites
current-user	Show current GlobalProtect gateway users
flow	Show dataplane GlobalProtect gateway tunnel information
flow-site-to-site	Show dataplane GlobalProtect site-to-site gateway tunnel information
gateway	Show list of GlobalProtect gateway configuration
previous-satellite	Show previous GlobalProtect gateway satellites
previous-user	Show previous user session for GlobalProtect gateway users
statistics	Show statistics of current GlobalProtect gateway users

I hope this helps.

Re: GlobalProtect, Working from Home (WFH) Prisma Access and Covid-19 (Coronavirus)

dannon — Tue, 17 Mar 2020 18:55:53 GMT

Joe,

I'd like to request that this information also be viewable in the GUI as well, maybe under "monitor"?

Always nice to be able to get the info in both places.

Maybe add this as a feature-request?

Re: GlobalProtect, Working from Home (WFH) Prisma Access and Covid-19 (Coronavirus)

googol — Tue, 17 Mar 2020 18:59:31 GMT

Its a work in progress, but they started having this data in PAN OS 9.1

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/globalprotect-features/enhanced-logging-for-globalprotect.html#id13cfe4be-8017-410c-866b-c6d232fe0082

Re: GlobalProtect, Working from Home (WFH) Prisma Access and Covid-19 (Coronavirus)

jdelio — Tue, 17 Mar 2020 19:11:40 GMT

@googol , thanks for posting that.

@dannon , I am sorry I didn't give all that info.

And just like you wanted, this is available under the monitor > Logs > GlobalProtect. and under the ACC > GlobalProtect Activity. Under PAN-OS 9.1

Re: GlobalProtect, Working from Home (WFH) Prisma Access and Covid-19 (Coronavirus)

dannon — Tue, 17 Mar 2020 19:17:19 GMT

Dang!

We are only on 8.13 because of bugs in 9.0 / 9.1 we experienced and had to roll back.

Glad it will be there when we finally move to the newer code.

Re: GlobalProtect, Working from Home, Prisma Access and Covid-19

mike.pochan — Tue, 17 Mar 2020 20:00:59 GMT

All the Prisma Access North American gateways show as healthy on the status dashboard but from our perspective it is virtually unusable (especially US-WEST). Is there any way for us to determine what gateway's are under the most load? Right now we're essentially playing hot potato and telling users to switch to other ones as performance degrades

Re: GlobalProtect, Working from Home, Prisma Access and Covid-19

jdelio — Tue, 17 Mar 2020 20:45:08 GMT

@mike.pochan

Please open a case with support on this issue, as we want to help ensure that there are not any performance issues with Prisma Access.

Re: GlobalProtect, Working from Home (WFH) Prisma Access and Covid-19 (Coronavirus)

jmenon — Wed, 18 Mar 2020 06:35:16 GMT

Review GlobalProtect License requirements here

https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/globalprotect-overview/about-globalprotect-licenses.html

Re: GlobalProtect, Working from Home, Prisma Access and Covid-19

raji_toor — Thu, 19 Mar 2020 17:09:49 GMT

Can we implement QoS for globalprotect sessions

Re: GlobalProtect, Working from Home (WFH) Prisma Access and Covid-19 (Coronavirus)

raji_toor — Thu, 19 Mar 2020 17:46:07 GMT

@jdelio I seem to cant access the link with either live or support account

https://paloaltonetworks.my.salesforce.com/kA10g000000ClkB?srPos=1&srKp=ka1&lang=en_US

Re: GlobalProtect, Working from Home (WFH) Prisma Access and Covid-19 (Coronavirus)

jdelio — Thu, 19 Mar 2020 17:51:45 GMT

@raji_toor

Sorry for that, please try this link instead..

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClkBCAS

fixing the other link now.

Re: GlobalProtect, Working from Home, Prisma Access and Covid-19

jmenon — Thu, 19 Mar 2020 17:59:09 GMT

@raji_toor see if this helps. https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/GlobalProtect-Implement-Split-Domain-and-Applications/ta-p/316929

Re: GlobalProtect, Working from Home, Prisma Access and Covid-19

jdelio — Thu, 19 Mar 2020 19:05:05 GMT

@raji_toor

To answer your question about QoS and GlobalProtect.. Yes, you can.

Here is a link to a Learning Happy Hour that talks about Throttling with QoS

https://live.paloaltonetworks.com/t5/Learning-Happy-Hour-Articles/Throttle-Bandwidth-Hogs-Using-QoS-Episode-3-Learning-Happy-Hour/ta-p/246410

The only note that I can help add about GP and QoS is:

When an interface that is part of an existing QoS configuration is later configured to be part of a tunnel configuration (IPSec, GlobalProtect, etc.), the Palo Alto Networks device expects QoS to be applied to the tunnel traffic. Apply the default/custom QoS profile to the tunnel traffic.

I hope this helps.

Re: GlobalProtect, Working from Home, Prisma Access and Covid-19

jdelio — Mon, 23 Mar 2020 15:18:26 GMT

Just wanted everyone to know that we have created a brand new area on the LIVEcommunity, it is the Covid-19 Response Center.

It is hard to miss it once you are on the LIVEcommunity, just look at the top Navigation, and you will see "COVID-19 Response Center" or you can click here:

https://live.paloaltonetworks.com/t5/COVID-19-Response-Center/ct-p/COVID-19_Response_Center

We have worked hard to combine a lot of great resources to help answer your common GlobalProtect and Prisma Access questions.

Be sure to check it out if you haven't already.

Re: GlobalProtect, Working from Home, Prisma Access and Covid-19

sumitsingh14 — Thu, 26 Mar 2020 12:01:23 GMT

Hi Team,

Can we can achieve remote vpn load balancing while using global protect on palo alto....if yes,can we add firewalls in a cluster to increase support to increased users...how can we do this between firewalls are different sites

Re: GlobalProtect, Working from Home, Prisma Access and Covid-19

jdelio — Thu, 26 Mar 2020 16:57:31 GMT

@sumitsingh14

Please allow me to respond..
1. HA is for redundancy, not for adding capacity.

2. In a Single Gateway instance, there is no balancing of the GP traffic. As one client will connect to a gateway.

Taking that a step further, You can setup multiple gateways. When the client connects to the one portal and downloads the list of gateways, the client then connects to the gateway that responds the fastest. So sort of load balancing depending on load and response time.