About JohnQuile

@LarsAtConsigas  There's nowhere in Okta to import a certificate so i guess we can't do this with Okta?  ... View more

Hi @LarsAtConsigas , What about for Okta if we don't use Azure AD for this?  We use GlobalProtect and VPN.  Okta's guide here says to not check the Validate Identity Provider certificate: https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-Palo-Alto-Networks-GlobalProtect.html ... View more

HI sorry but how do I know if I have gateway license? Don't I have that already if I have a portal and GlobalProtect license? ... View more

Sorry, well one example would be if I wanted to block a user from VPN. It says to go to Monitor > Logs > HIP Match and get a HostID.  But this log section is all empty.    When I go to Network > GlobalProtect > Portals, open the portal and look at Agent > config > Data Collection there is a checkbox on "Collect HIP Data" checked.    So I'm not sure where the "Collect HIP Data" stuff is going, or what I can even really do with it beyond blocking a VPN client. Perhaps I want to only allow VPN with up to date AntiVirus. I'm guessing this HIP data comes into play on that as well? But I'm not seeing the connections (in the context of documentation) on how.  ... View more

That worked -- just added routes from the secondary VR to subnets of where our workstations were to go through the next vr.  Failover worked flawlessley. Not time to consider Policy based forwarding next.  Hope this helps the next average Joe! Thanks for guidance, @Raido_Rattameister. ... View more

HI @Raido_Rattameister, Sorry I meant to include screenshot earlier, if this helps identify any issues you see?    So basically, I need to add a route there on the "Virtual Router - guest-vr" to the subnet of computers that go through the "trust-vr" Virtual Router"?    ... View more

@Raido_Rattameister Well I will definitely first try the route setup next. I'm excited that it makes sense and am motivated to try this at the next earliest, possible maintenance window overnight versus weekend.  Let me give this a go, and report back. Hopefully you won't mind visiting back to see how it goes.  Thanks very much  ... View more

@Raido_Rattameister Ahhh ok that makes sense. I will try that. So that would still be require if I did Policy Based forwarding too? But if i consolidated to one VR it would make it easier ? ... View more

@Raido_Rattameister,   Well I'm not sure. Would this be established via a Static Route within the VR?  As far as VR2 route back to VR1, this could be setup so only when it is failed over? Because on a normal day to day basis, VR2 with ISP2 is used all day as a guest network and functions fine.  It's just trying to leverage it as a failover for our ISP1 and corp zone when ISP1 goes down.    ... View more

@Raido_Rattameister,   The 2 Virtual Routers existed before I inherited the management of the PA (inherited by network admin leaving, which hopefully explains my newbiness). I am not sure I can swap out everything with 1 single Virtual Router and a PBF right now. I was hoping to just get Path Monitoring setup with current setup to get ISP redundancy soon, and then have some cushion later to play around with 1 VR and PBF.   When I tested the ISP failover with how it is setup now, enabling Path Monitorign to ping a phantom IP (32.32.32.32), it just disconencted my laptop and I couldn't ping or get to websites. When I checked the traffic log, I could see my requests going to new destiation zone and interface of ISP2, and ISP2's NAT IP. But on my laptop I just got errors in my browser when trying websites, and no reply when pinging 8.8.8.8 in cmd prompt.   The "General" application log says "incomplete" though for that traffic. PA support advised maybe it is another switch, that the PA is handing traffic back into our network but my laptop is not getting it? I am not sure what to check to troubleshoot this. we do have 2 HP switches in the MDF ... View more