About OwenFuller

That's what they told me to do as well, but it's already enabled. Still broken. About to give up on this, and just close my TAC case. ... View more

Well that's good to know. Unfortunate, but good to know. I'll pass this along to TAC. ... View more

Case still open. Last troubleshooting session was yesterday. Not much progress though, in my opinion. ... View more

I still have an active TAC case open. More troubleshooting on Monday. ... View more

Thanks for the suggestion. Unfortunately, the guidance at /api doesn't get that granular for commit-all.   It turns out that the answer was to add a </entry> tag after the serial number entry as shown:   <entry name="<serial_number>"></entry>    Then, to get it to run properly in Powershell, add backticks to escape quotation marks around the DG name and serial number. ... View more

Sorry, I deleted my last comment, as I thought you were trying to turn a ZTP firewall into a non-ZTP firewall. As I understand it, there is a separate physical chip (or chips) on the ZTP firewalls that is not present on non-ZTP models. ZTP models also have a claim code listed on them, which is needed to activate them w/ the ZTP service. The ZTP service at Palo Alto is expecting to match the serial/cliam key w/ a hash in a database when it connects. There isn't a way to make a non-ZTP device use ZTP. ... View more

We recently resolved this by adding ipsec-esp-udp as an allowed app on our security policy for GP. IPSEC connections started working again, and the notice went away. ... View more

I've noticed this (new?) setting in the GP agent app config. It doesn't appear to be documented, nor does it appear to do anything. I know from previous experiences, that certain GP features are introduced in content releases, rather than in PanOS updates, so maybe this is something "in the works" at the moment. Just thought I'd pass it along for others. If anyone comes across info on this setting, please share.   ... View more

Check to see which certificate profile is listed under Templates > Network > GlobalProtect > Gateways > your-gateway > Authentication > Server Authentication Find this profile under Templates > Device > Certificate Management > SSL/TLS Service Profile and take note of which certificate is used. Find this certificate under Templates > Device > Certificate Management > Certificates Check that CN of the subject matches the gateway address specified in the portal configuration under Templates > Network > GlobalProtect > Portals > your-portal > Agent > your-agent-config > External (or Internal) > External Gateways Check that today's date does not fall outside the Not Valid Before/After dates (also check that system time on the GP client machine is correct. If everything looks good, try exporting your logs from the GlobalProtect client, and looking at PanGPS.log for clues. ... View more

I agree with @rmfalconer on the route metric issue. That's why I'm thinking ECMP with the symmetrical return option might be your best bet. I've not tried this with multiple VRs in the setup you have described. You could try it though, and if necessary, move all three ISPs to the same VR. ... View more