AWS VPN Tunnel and Path Monitoring

I have 2 AWS instances(Prod and Stage) each with redundant VPN tunnels to the same remote end Palo.  I setup path monitoring for each so that when one tunnel is down, the route is removed and the backup route is put in the FIB.  This only works with

Delete GlobalProtect Client from firewall

On a PA-500 we locally downloaded the GlobalProtect client and activated it. Now we want to remove it from the firewall, because we are deploying it via our software deployment and the users should not be able to download it directly from the Porta

Disable GlobalProtect option unavailable

No Disable option available although its set to allow with comment. GP version 5.1.4

Log collection after migrating Panorama from legacy to Panorama mode

Hi Community,

Hope all of you are doing great and healthy.

I have a little issue I´d like to check with you for some advice.

I´m migrating 2x Panorama VM in HA from legacy to Panorama mode with M-100 log collector in a collector group.

https://docs.pa

GlobalProtect configuration issues

We are trying to setup a new portal, changing some default app settings.

Although display traffic block message is selected to yes, it still does not display message although enforce-globalprotect is set to yes.

Also to exception-list i added few test

cannot export cert - failed to process command

No issues exporting other certs as PKCS12 or PEM w/ key

I have tried from multiple browsers on multiple machines - all same thing

When I enter passphrase and click ok. I download an error.txt that states "Failed to process command"

I tried reloading the

Sectigo CA Chain Decryption Issues

Due to the recent expiration of the Sectigo RSA CA cert (https://support.sectigo.com/articles/Knowledge/Sectigo-AddTrust-External-CA-Root-Expiring-May-30-2020) and our Palo firewall SSL decryption policy configuration to block expired certificates we

Monitor Firewalls through Panorama (SNMP, API query ...)

Hello,

I am trying to monitor some firewalls via snmp but just asking to the Panmorama devices that are managing these firewalls:

If I run a snmpwalk using this OID 1.3.6.1.4.1.25461, the information about the firewalls that I get from the Panorama is

Route the Internet Conference Application Traffic to Second Internet Line

We would like to set the Internet Conference Application (like WebEx, Zoom and GoToMeeting etc) use another Internet Line.

But we check on the NAT is need set by Service Port, and the Policy Base Forward cannot set the application like WebEx, Zoom and

PaloAlto Firewall - Onsite Spare Unit Ownership Issue

Dear,

We are planning the refreshment the Firewall, and this has an option for Onsite Spare Unit.

If we purchase the firewall with OnSite Spare (OSS), WHO is ownership of the OSS hardware (end-user customer or vendor/SI or PA)?

Thanks & Regards,

James