About Gustavo_Aristi

Gotcha, no problem. Whomever installed Cortex XDR agent on your device perhaps your IT department, or your managed services provider, etc, would know.   That is the central point of intelligence for your Cortex XDR deployment. Your Cortex XDR agent is connected to it and sends information to this central location and this central location sends information back to your device as well as instructions.   Your Cortex XDR / IT / Security team could also report the verdict as incorrect as follows:   I would first take a look at the previously mentioned Wildfire report to get a concrete idea of what triggered this verdict. This is potentially something that the developers of the the radioplayer app will find useful and will address it.     ... View more

I had a similar instance with the Spectrum App.  I would recommend to go to the Cortex XDR tenant and find this specific incident. Locate the wildfire information and identify the action/behavior that triggered that verdict.   In the case of the Spectrum mobile app, I downloaded the Wildfire report from Cortex XDR and found out that this app was trying to contact a fishy URL. The URL had no information and was potentially malicious (virustotal was inconclusive I think, can't remember), it could have been just a brand new domain which could also trigger URL filtering to flag as malicious.     Example of another similar incident:   ... View more

This is very cool!   The minimum is still 200 licenses per tenant though.   Wondering if it will be reduced sometime. ... View more

In case anyone is wondering the same thing. The answer to my question above is:   Expiration is assigned/selected at the time of creating the quote in the system. No need to worry about it while estimating the amount of credits. ... View more

Thanks a lot for checking! 🙂 ... View more

Greetings Seo.   The fact that users have to enter credentials each time they attempt a connection is a best practice for a strong security posture.   However, if you want credentials to be remembered, try this: Network > GlobalProtect > Portals > <portal-config> > Agent > <agent-config> > Authentication   Let us know if that works for you!   ... View more

Hi Sujanya.   Below is the ultimate resource for anything Expedition. There are even FAQs, videos and more:   https://live.paloaltonetworks.com/t5/expedition/ct-p/migration_tool   I hope it helps! ... View more

Like some have already mentioned, this is indeed possible through a loopback interface.   Here's a working link to this KB:   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGKCA0   If GlobalProtect is in Azure (SAML), make sure to change the port here to your desired one:     ... View more

In case someone else is trying to get an answer to this (I'm sure the original participants in this thread already did).   The Clientless VPN feature of GlobalProtect requires a "GlobalProtect Gateway" license. Same goes for HIP related features, mobile app support, etc:   https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/globalprotect-overview/about-globalprotect-licenses   Also the "GlobalProtect Portal" license is discontinued: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClG0CAK   However, there is A LOT of GlobalProtect functionality that is available without the need of a license. A lot of deployments, don't need a license. I would recommend to confirm the feature needed is not part of the standard (without license) functionality in order to avoid an unnecessary purchase.     ... View more

Hi @jdelio  At what point do you request or specify an expiration? What if you want 5 years for example.   The credit estimator tool does not have that option and I can't see any details anywhere.   Thanks! ... View more

There seems to be some confusion about the PA-220/PA-220r EoL (we just had a discussion about this with our team and a PANW resource).   The EoL documentation states the PA-200 is EoS (not EoL yet). Notice that this is NOT the PA-200 series but the actual PA-200 model (see below for URL). The PA-220 and PA-220r are not yet officially slated for EoL/EoS. However, it is a good idea to consider the PA-400 series instead of the PA-220/PA-220r as their life is reaching its end.    https://www.paloaltonetworks.co.uk/resources/datasheets/pa-200-specsheet   https://www.paloaltonetworks.com/services/support/end-of-life-announcements/hardware-end-of-life-dates   ... View more

From: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-release-notes/limitations/limitations-in-pan-os-10-1   "The PA-410 does not write session logs locally. As a result, the PAN-OS Web Interface does not display any logs in the  Monitor tab."   Just out of curiosity, what would be the output of the following command against a PA-410?   show log traffic direction equal backward or show log traffic   I assume it will fail or return nothing? ... View more

Hi, wondering if you resolved this issue.   Try creating a custom URL category with the below URLs: *.update.microsoft.com *.windowsupdates.microsoft.com *.windowsupdate.com windowsupdates.microsoft.com   And create an allow security policy using this custom URL category. Place it right above the current policy being matched.   I hope that helps. ... View more

In short, the answer to your question is no. Only via CLI you can view the user-IP mapping table.   You might be able to pull this off via the API.   To try, you can go to: https://yourFWIP/php/rest/browse.php/user-id   Let me know if you figure it out (if you are interested to go that route).   Thanks. ... View more

I am sorry you are going through this, I am sure you'll find the solution.   At this point, since you are already at the pcap stage, I would perform a packet diagnostics, flow basic and look at a low level what the firewall is doing with each packet/session in the flow logic.   I bet you are familiar with that or already tried it, but if not, below is a good read: https://live.paloaltonetworks.com/t5/general-topics/debugging-packet-flow/td-p/67514   My approach for reading these is different, I get a TSF and find the txt file there and open it in notepad++ ... View more