About kiwi

kiwi · ‎08-05-2025

Hi @Mahendran.M , A little more context would be helpful. What error are you seeing where exactly ? My guess would be it's still configured for use on your firewall. Check on the firewall under the Device tab > Server Profiles > Kerberos or check if the profile is still being used in Device tab > User Identification > User Mapping > Palo Alto Networks User-ID Agent Setup Kind regards, -Kim.

kiwi · ‎08-04-2025

@omkar , You can find this information in the Associated Content and Software versions: https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-release-notes/associated-content-and-software-versions/associated-content-and-software-versions-for-pan-os-11-1 Hope this helps, -Kim.

kiwi · ‎08-04-2025

Hi @${userLoginName} , Sounds like you're running into a race condition where the GlobalProtect service starts before the network stack is fully initialized. Have you tried delaying the startup ? You should be able to locate the PanGPS service in services.msc and change the startup type from "Automatic" to "Automatic (Delayed Start)". This should tell Windows to wait a while after all critical system services have started before it runs the PanGPS service, giving the network stack plenty of time to initialize. If I'm not mistaken the default is 2minutes delay. Hope this helps, -Kim.

kiwi · ‎08-04-2025

Hi @Carracido , The conflict between Graceful Restart (GR) and Bidirectional Forwarding Detection (BFD) is an architectural issue that applies to any dynamic routing protocol. It is not specific to OSPF or BGP. The problem arises during an HA failover or any event that causes a brief disruption. BFD, being extremely fast, will detect the disruption and tear down the session with the peer device. This rapid action from BFD overrides the slower process of Graceful Restart. This can lead to the routing tables being flushed and an extended outage, exactly as you described In summary, the problem is not tied to the specific routing protocol (OSPF, BGP, etc.) but rather to the conflicting nature of BFD and GR. They are designed for different types of failures, and when both are active, BFD's speed typically overrides GR's grace period, leading to the kind of extended downtime you are seeing. Hope this helps, -Kim.

kiwi · ‎08-04-2025

Hi @QGCNetworks Yes this is expected behavior. Palo Alto Networks changed how the configuration for path monitoring on static routes is handled to reduce the size of the configuration. In older versions of PAN-OS, the firewall would explicitly show a path-monitor section for every static route, even if it was disabled. In more recent versions of PAN-OS, this explicit, non-functional configuration is no longer stored in the running config if it's not in use. When you make a change to a static route via Panorama and commit, the system recognizes that this default configuration is unnecessary. It then removes the explicit path-monitor section from all existing static routes, as it's no longer required by the new configuration standard. This change is purely cosmetic and does not affect the operation of your firewall. Path monitoring will continue to work correctly if you have it enabled on other routes. If it's not enabled, nothing will change. This is a deliberate change by Palo Alto Networks to make the configuration cleaner and more efficient. It is explained in this document: Commit preview shows path-monitor config for static routes deleted unexpectedly when adding a static route to a virtual router Hope this helps, -Kim.

kiwi · ‎08-04-2025

Hi @NYanico , I haven't tested this myself but have you tried using PBF and enabling symmetric return ? I'm thinking about creating a PBF rule that forces any traffic originating from the GlobalProtect tunnel interface (Loopback.1) to use the same ISP that the original connection came in on. Enable the "Symmetric Return" optionand specify the public IP for ISP B (10.10.20.3) as the return address. This tells the firewall to force return traffic for this specific NAT session to egress the same interface it came in on, overriding the default routing table. How to configure symmetric return. Hope this helps, -Kim.

kiwi · ‎08-04-2025

Hi @SoongNyeongKim , That being said, because this was brought up before I think it's would be a good candidate for a feature request. For new features or product enhancements, the most effective way is to go through your dedicated Palo Alto Networks account team. Contact Your Sales Engineer (SE): Your SE is the primary point of contact for submitting feature requests. They have direct access to the product management team and can formally submit your request into the internal system. Provide Details: When you contact your SE, be prepared to provide a detailed use case. Explain why the feature is important and the business problem it would solve. This helps the product team understand the value and prioritize the request. Voting on Existing Requests: If a similar feature has already been requested, your SE can add a "vote" on your behalf. This is crucial because the number of votes a feature receives from customers directly influences its priority and can expedite its development. This process ensures your feedback is formally tracked and considered by the company's product development team. You can also ask users here to add their vote to it once you get a FR#. Kind regards, -Kim.

kiwi · ‎08-04-2025

Hi @Alpalo , There might be other reasons why you are seeing sessions end unexpectedly with the error resources-unavailable. In bug PAN-226361 this was related to packet-descriptors and memory pools being interpreted incorrectly as depleted. For example, I've seen similar reports related to ctd_pkt_queued and ctd_pkt_queued_proxy counters going into the negative (PAN-270549). This also leads to sessions ending with reason 'resources-unavailable' or sessions bypass l7 inspection. The behavior you're seeing might have a different root cause. I'd recommend generating a TSF and submitting it to tech support for analysis. Kind regards, -Kim.

kiwi · ‎08-04-2025

Hi @nadji.salazar , For login assistance, please refer to the following page: https://www.paloaltonetworks.com/services/support/login-assistance Kind regards, Kim.

kiwi · ‎08-04-2025

Hi @wilkinsong , That's a great idea for enhancement. That said, for new features or product enhancements for GlobalProtect, the most effective way is to go through your dedicated Palo Alto Networks account team. Contact Your Sales Engineer (SE): Your SE is the primary point of contact for submitting feature requests. They have direct access to the product management team and can formally submit your request into the internal system. Provide Details: When you contact your SE, be prepared to provide a detailed use case. Explain why the feature is important and the business problem it would solve. This helps the product team understand the value and prioritize the request. Voting on Existing Requests: If a similar feature has already been requested, your SE can add a "vote" on your behalf. This is crucial because the number of votes a feature receives from customers directly influences its priority and can expedite its development. This process ensures your feedback is formally tracked and considered by the company's product development team. Kind regards, -Kim.

kiwi · ‎08-04-2025

Hi @cmramosfors , Here's a recent blog I created that explains the changes in PANW certifications and how to prepare: https://live.paloaltonetworks.com/t5/community-blogs/embracing-your-role-palo-alto-networks-certifications-get-a/ba-p/1232381 Hope this helps ! Kim.

kiwi · ‎08-04-2025

Hi @Buko84 , The GlobalProtect client is designed to automatically try to connect to a pre-defined portal when PLAP is enabled, but since none is set, it gets stuck. The user interface for entering the portal address is not shown at this stage because the PLAP is already running in a dedicated pre-logon context. You can fix this by pre-configuring the portal address in the Windows Registry. If I'm not mistaken it's explained in this DOC: https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-apps/deploy-app-settings-transparently/deploy-app-settings-to-windows-endpoints/deploy-connect-before-logon-settings-in-the-windows-registry Hope this helps, Kim.

kiwi · ‎07-18-2025

Hi @A.Kuszaj , Root and intermediate CA certificates expire, or new ones are issued, and the Palo Alto firewall's trusted CA store needs to be updated to reflect these changes. Since it was working for two years and stopped about a month ago, it's probable that a certificate in DuckDNS's chain either expired or was updated, and your firewall hasn't updated its trusted CA store accordingly. Possibly you may have to install and set the Intermediate Certificate as a Trusted Route CA. You may have to delete and recreate the Certificate Profile for this to take effect. Here are a few things you can check: Clarify which certificate chain you have installed to the firewall ? Refer to the article link to install correct intermediate CA on the firewall: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm66CAC Validate the DDNS configurations referring to this document link: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/configure-dynamic-dns-for-firewall-interfaces Please refer to this article link providing resolution for Error message: Peer certificate cannot be authenticated with given CA certificates: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLz3CAG&lang=en_US%E2%80%A9 Hope this helps, -Kim.

kiwi · ‎07-17-2025

This Nominated Discussion Article is based on the post "Configure Split tunneling by domain" by @BigPalo and responded to by @Raido_Rattameister and @BPry Read on to see the discussion and solution! Hi, I just configured split tunneling by domain using this domain test: *.portal.microsoft.com (port 443) But i can not see this traffic going into the tunnel. how can I troubleshoot this? Note: If you configure split tunneling for a domain then you effectively configure this domain not to be routed into the tunnel but directly towards Internet. Some considerations: Do you have a GlobalProtect license so that you can actually utilize this functionality? Have you verified for sure that the traffic isn't attempting to utilize QUIC? This functionality only works with TCP traffic and if your browser is using QUIC (which is UDP) it won't function properly. What agent version are you using. As far as troubleshooting goes you'll want to set your client logging to debug and look in the logs for the domain in question and look for an entry in PanGPS.log that looks like what is denoted below: (P6668-T26348)Dump (2039): 07/04/25 03:02:58:982 Domain name wxt-general-ingressgateway.acmhwxt-prd-1.prod.infra.webex.com matches exclude wildcard domain This will tell you whether it's matching your rules or not.

kiwi · ‎07-16-2025

Hi @Carracido , The error in question strongly suggests an issue with TLS/SSL negotiation, specifically related to the strength of the encryption ciphers or protocols being used. In the handshake you should be able to see what ciphers/protocols are being negotiated. I believe the following discussion provides a solution to bypass decryption for anydesk: https://live.paloaltonetworks.com/t5/general-topics/solution-for-quot-ssl-decryption-bypass-for-anydesk-quot/td-p/385369/page/3 There was a different approach on reddit: https://www.reddit.com/r/AnyDesk/comments/1jm1xjg/issue_with_palo_alto_ssl_decryption_not_liking/ Hope these help. Kind regards, -Kim.

Member Since	‎03-24-2011 01:31 PM
Date Last Visited	‎09-09-2025 07:49 AM
Posts	3,179
Total Likes Received	1680

Online Status	Offline
Date Last Visited	‎09-09-2025 07:49 AM

About kiwi

Re: PCNSE Learning plan under maintenance

Re: Investigate Bandwidth utilization on Palo Alto Firewall

Palo Alto Networks Introduces PAN-OS® 12.1 Orion

Re: Norton 360 isn't detected by GlobalProtect

Re: Threat ID 31671 - SCADA ICCP Unauthorized COTP Connection Established

Re: XSOAR virtualization support

Re: The PAN-OS fixed version information

Re: Cybersecurity Fundamentals Course Showing “In Progress” After Completion.

Re: Anyone has experience working with Public Certificate and OpenSSL for Palo Alto SSL/TLS Service Profile

Re: Is it possible to integrate Palo Alto with Radius to send Global Protect events?

Palo Alto Networks Introduces PAN-OS® 12.1 Orion

Re: The PAN-OS fixed version information

Nominated Discussion - Sorting Question

Re: web browsing slowness

Nutanix DAG Harvesting Panorama Plugin

Re: Does anyone have any experience with Expedition

Re: DHCP Relay for GlobalProtect

Re: block geo location IP version 6

Re: Bulk changing target device in policy set

Re: VPN is not working with airtel air fiber

Re: Kerberos error

Re: Support FAQ: Upgrading PAN-OS and Upgrade Paths

Re: GP User-logon (Always On) doesn't connect

Re: BFP with OSPF graceful restart causing outages during failover

Re: Panorama changes after static route added

Re: Global Protect Dual ISP

Re: Is it possible to configure PA to send a reset(rst) packet when a session timeout occurs?

Re: About BUG PAN-226361 for PA-820 device running version 10.2.10-h9

Re: Issues with the Customer Support Portal (CSP)

Re: Global Protect Product IDEA !

Re: What is the replacement of PCNSA certification?

Re: Global Protect before logon shows "Connecting" just after -registerplap with no portal set

Re: Problem with the DuckDNS certificate for the DDNS service.

Nominated Discussion: Configure Split Tunneling by Domain

Re: decryption error with Anydesk

Unlock your full community experience!

About kiwi