General Topics

Resolved! How can I filter disabled rules in the 'policies'-tab

Hi,I am quite new with Palo Alto and I try to filter disabled rules, so that I only see the enabled rules. I know that a lot of syntax can be found in the monitoring tab, but since enabled/disabled rules are not in it, I cannot find. It is on the Palo alto itself, not Panorama.

Show Hard Drive information

For an audit, I need to know the Make/Model/Serial Number of the internal HDD. I cant seem to locate the appropriate show command on a PAN device...any ideas?Thanks much

Sending Before Change and After Change details in Panorama to Syslog

I've been testing the logging of change events to a syslog server from Panorama. Syslog events indicate a change made by a person and the general section of the change without giving any specific details of what was changed. Looking in Panorama in the Monitor tab I can see the change event and some details that are sent to syslog, but the deta...

Defining patch management in HIP objects.

Hi All,We are configuring global protect with HIP enabled.Our requirement is, If the patch defined in the HIP object is missing in client machine then access should be denied. Below screen shows the patches (windows updates) for windows 7 machine.From above snap i want to use the highlighted update as match in HIP object (If this update is missi...

Resolved! BGP Graceful restart in an Active/Passive cluster?

All,Quick query, we are in the process of implementing a HA cluster that will be BGP peering with several upstream routers, both route import and export, and in trying to reduce the interruption due to a failover we are looking to implement the Graceful Restart option.My question is...... will this have any effect?I was not sure how, in the case...

Resolved! IPSec VPN Setup for Avaya Phone

I am attempting to setup an IPSec VPN tunnel to connect to remote Avaya phones. I am not sure if I am doing it correctly. I've set up a new IPSec tunnel and configured it to use dynamic IP for remote peers. I am not sure if this is correct or not. It seems to me this would be for a site-to-site VPN. I believe I am looking for more of a client VP...

GlobalProtect Client Auto Login Woes

Hello,We are testing the GlobalProtect Client (version 1.2.2-14) and are experiencing an issue. We use Windows automatic login for some custom deployment tasks, but are experiencing odd behavior and possible bug.With the AutoAdminLogon, DefaultUsername, and DefaultPassword registry keys set, Windows will automatically log into the specified loca...

User mapping - IdleTimout and MaxTimeout architecture with GlobalProtect only (no User ID agents)

We have a setup for up to 2.000 employees. Every employee has the GlobalProtect installed, but we are not using any User ID agent.We have only one portal configured, for both internal and external (vpn) connections.On both gateways (internal and external), we have configured the client tab with a Login Lifetime to 7 days and the Inactivity Logou...

Resolved! GlobalProtect Portal HTTP redirect

Dear all,We're currently testing the GP VPN solution before we roll it out to our notebooks. We noticed that we can only access the portal homepage if we explicitly enter "https://<portal-url>". It doesn't work with just "<portal-url>" there HTTP would be used. Is there any way to activate an HTTP to HTTPS redirect for the GP portal?...

Resolved! IPSEC Tunnel to ASA - PeerID issues

I am setting up an IPSec tunnel to an ASA. I am getting an error message about the PEERID type only allowing IP but received FQDN. Per the other KB article, I changed the PAN Exchange mode to Aggressive. Now the PAN received a FQDN of the ASA side and gave listed the FQDN in the system logs.My question.. where in the ASA can you configure PEER a...

GlobalProtect client behind a proxy, configuration help

I am trying to establish an ssl vpn connection using the globalprotect client, but the client is behind a proxy using a configuration script. I have tried calling paloalto support but they said their client is not proxy aware. Does anyone know of some things I could try to get the globalprotect ssl vpn client to work from behind a proxy?

Resolved! GlobalProtect Local LAN Printing

I have GlobalProtect running for machines when they are off the network. Is there anything that I need to setup that would allow them to be able to print to their local LANs even though the agent is connected back to the FW? I am currently testing this right now, but users most definitely will need to print when not in the office, so I am hopi...

block gmail personal ID and allow gmail official ID in palo alto

Hi Friends,please suggest,block gmail personal ID and allow gmail official ID in palo alto.RegardsSatish

Resolved! Globalprotect Portal same IP w/ management interface

Hello,Before setting up globalprotect portal, I could access the management interface using the public IP externally. Once I configured globalprotect portal for VPN, the IP now directs you to globalprotect welcome login page. Which is normal, cause I remember reading that, and you can access the administrative interface with the same IP and addi...

GlobalProtect - how to edit the download page

Is it possible to edit the GlobalProtect download page?On the page where users are prompted to download the 32bit, 64bit, or Mac version version of GP, I would like to add some instructions for the not so savvy user on which version to select and how to install the client. If there's a better way of doing this I'm open to it. Setting it up via...