General Topics

Join Us For a Fuel Workshop on GlobalProtect Troubleshooting Techniques (APAC Region Sept 17-18)

Fuel Workshop on GlobalProtect Troubleshooting Techniques Welcome to the next in our series of Fuel Workshops where will be covering troubleshooting techniques for GlobalProtect. Over the next two days, we will be learning a number of items related to supporting as well as best practices around how to build a proper GlobalProtect environment...

Resolved! Multiple Global Protect gateways on same firewall

I have a PA-3020 that will have two ISP connections. Primary ISP interface will be used for the Global Protect Portal and Primary Gateway using tunnel.1. Is it possible to have a second gateway using tunnel.2 on the same firewall using the secondary ISP interface? Also, if the Portal is only on the primary ISP interface and that connection is...

Resolved! GlobalProtect, Working from Home, Prisma Access and Covid-19

To all, Just wanted to post a message about the Hot Topic right now, which is Covid-19. With all of this going around, everybody's health and safely is the utmost concern. Keeping your hands clean, washing your hands (A LOT), using hand sanitizers, and stop touching your face (I see you doing it now). One of the things that is happening all ...

When will a new GlobalProtectClient GUI/UI be written?

We've been holding off replacing our Cisco Anyconnect clients as the interface of GlobalProtect is a big downgrade for us. Any idea when/if there will be improvements made to the GP UI? At the moment it looks like it was developed by engineers with no UI team. Why do you have to go into a menu to connect to the VPN? It's the sole/single purpose ...

GlobalProtect Client not Connecting

Hi All, I'm experiencing a problem with GlobalProtect and I'm hoping I can get some assistance. I'm able to log on to the GlobalProtect Gateway. I successfully log in and Download the agent. However, when I click 'Connect'. I get an error that says: 'CONNECTION TO SERVICE SOCKET FAILED'. I tried collecting logs from the GlobalProtect clien...

Resolved! Can't remove vsys specific SSL TLS Service Profile

This is a strange issue. PA-3020 recently upgraded to 7.0.4. The firewall is in single vsys mode. I installed new SSL certificates for Global Protect. Somewhere during the process of installing the new certificate and upgrading to 7.0.4, an ssl-tls service profile was automatically created. I didn't create it. I'm trying to delete that c...

Resolved! Trusted Root CA Not Installed on Client?

This is on a PA-3020 running PAN-OS 7.0.4. I've always manually chained certificates when installed an SSL certificate for Global Protect. I decided to see if I could install the SSL certificate and the Intermediate certificates separately and see if it would work. I configured Global Protect Portal > Agent Configuration > Trusted Root...

How to disable Multiple Concurrent SSL VPN Sessions with One Username?

Hi All, I know that we can have Multiple Concurrent SSL VPN Sessions with One Username but my question is how to disable this feature? Thanks,Amir

Resolved! Does globalprotect client supports New OS X El Capitan?!

Configuring GlobalProtect with Wildcard Certificate

Hi All, I'm configuring GlobalProtect for the first time and would like to ask a few questions about using a Wildcard certificate to set this up. After going through the below document, I have some questions: https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Use-a-Wildcard-SSL-Certificate-with-Subject-Alternative/ta-p/52849 1. Th...

Global Protect Speeds?

Hi, realtively new to PAN, and have some questions related to Global Protect speeds. I have a win 7 x64 client connected to a gateway on my 3020. From the client to the internet over 30mbs of bw From the PA3020 VPN interface to the itnernet 20mbs of bw I set up file copies of large iso files and compare the speeds. pulling from server to clie...

Resolved! Global Protect Client settings

I Have configured Global protect and can successfully connect via clients. But after the initial instlal the users have to manually put in the port address along with their username and password.Is there a way to auto populate the portal address so the users do not need to know that info?

Global protect and HIP profiles problem

Hi, Lately I´ve been having issues with clients connecting to Global Protect. They pass the HIP match (no warning message is shown when they connect) but still the security policys with the HIP profile doesn´t apply, instead they hit a deny policy. After disconnecting and trying again for a couple of times it suddenly works and the appropriate s...