About Shawverr

Hello - Originally, I was going to setup GP with RSA MFA using this document: "RSA SECURID® ACCESS Implementation Guide Palo Alto Networks Next Gen Firewall 8.0"   It is written by RSA and is woefully lacking in detail and after seven hours on the phone with Palo support I decided to abandon that idea for now.   At this point I'd just like to get GP working in any capacity, but I can't seem to find any documentation that speak to what I need.  I understand that everyone's cirumstances are different and documentation would be tough to write for every unique situation.  That's why I'm hoping someone is willing to get out the coloring book and crayons to help walk me though this.   I'd like to have an external only VPN (just about every Google search come up with either Internal only or internal/external combo setups). Portal and gateway on same device.   I'm fairly certain that my main issue is with step one, the configuration of the Interface.  I'm trying to follow this: https://docs.paloaltonetworks.com/globalprotect/8-0/globalprotect-admin/get-started/create-interfaces-and-zones-for-globalprotect.html but clearly not having much luck.   Ethernet Internet setup like this: Interface  Type  Mgt Profile   IP Address    VR   Security Zone eth1/1      L3      Allow-ping   Routable.10/24   vr1   Outside   I have another routable.20/32 for GP.   What's the best way to get started.  Remember, coloring book and crayons.  You're not going to offend me. ... View more

We currently have one outside interface on the firewall and is connected to our Edge Router. The interface has the IP address of 10.10.10.10.5/24 (for example). This is the only port available for inbound and outbound data to the internet. We would like to create a new outside interface on the firewall and start using it for other services, such as our Global Protect VPN and so on. We would like to give the second interface the IP address of 10.10.10.10.6/32 but this IP falls in the range of the first outside interface of 10.10.10.10.5/24. Can we change the IP address on our existing interface to 10.10.10.10.5/32 instead of the /24? Will this impact anything? Then we could use the 10.10.10.10.6/32 for the second outside interface.   Thanks in advance. ... View more

Apologies for new guy question. I've been asked to set up GlobalProtect VPN with MFA and a HIPS check.  For example if there isn't a particular brand of AV the client is rejected.  My question (well, one of my thousand) is I don't understand how HIPS ties to the GlobalProtect connection.  I don't see anywhere in the setup where it says, "Use this HIP Profile for this Portal and if it doesn't match display this message".  I understand that is a pretty simplistic version of what I'm looking for, but hopefully someone gets what I'm saying.   Thanks in advance for your time. ... View more