About Remo

Hi @jhopple   You're right, this does not answer your question. It's only a tiny part of addressing this. So the more correct answer is: In general for new features, you have to ask your local paloalto sales team. If there are no plans for such a category you could also let them ceate a feature request. But here in the public community you won't got official answers about planned features. ... View more

Hi @Retired Member   The template variables in PAN-OS 8.1 sound like the feature you need. With PAN-OS 8.0 I don't see a way doing this without separate congihurations. ... View more

@Mick_Ball If you set the metric to 1 it is like @TBardIPsoft wrote. You are still connected but the trafgic is routed outside the tunnel. At least without the setting "no direct access to local network". With this setting enabled I need to test again.   But anyway, I kinda see it like TAC. A user without admin rights is not able to do route changes. Anf if a user has adminrights, there are way more security concerns than this route "issue". ... View more

Hi @RobinClayton   As for a lot of topics without solution, the solution is the XML API. If you really need something like that to check for used objects, you can write a script for doing exactly that: Parse the ruleset for all the objects used Lookup these objects in the configuration to get the ip address/subnet/IP range Use the information from point 2 to query the logs for each object/address one by one and exclude the drop all policy in your query Obviously depending on the size of the ruleset and the amount of objects this script can easily run for hours, but at the end you could have your custom object usage report.   Or use something like Tufin, to do this job. But even if you are not familiar with scripting, doing it by yourself is probably less expensive (unless you have other things wher Tufin would help you that are also time consuming) ... View more

Hi @jdprovine   Ok, thats true. But you could also have some teaminternal guidelines that make it easier for all when they know what's been done and noone needs to waist time searching for a change which may resultet in something not working anymore.   @kiwi probably also read this topic 😉 ... and if not it's luck that he posted a blog post exactly about this config log topic and the basics on how to automate this here: https://live.paloaltonetworks.com/t5/Community-Blog/The-Power-of-XML-API/ba-p/202789 ... View more

Hi @_slv_   Do you have session cookies enabled? These cookies are sent with every request so the user does not have to reauthenticate. When the browser is closed this cookie will be deleted and a new login is reauired. In combination with session cookies best practice is also to set idle and expiration timout to 1 minute. ... View more

Hi @anthony.goethals   Did you check if VT-x is enabled in the BIOS? https://en.wikipedia.org/wiki/X86_virtualization#Intel_virtualization_(VT-x)   Regards, Remo ... View more

There is an uptime value. Maybe this value helps in your situation. --> Now - uptime = starttime of the firewall But if the firewall was restarted then or if it simply was powered on you need to search in the systemlogs. ... View more

Hi @mlinsemier   This would be something really interessting to try out. In theory it should work with global protect (client or satellite configuration) as this is a standard/RFC compliant IPSec VPN connection. But if this really works in a real situation, I have no idea. If you try it, please share your results here in the live community.   Regards, Remo ... View more

@jdprovine This is bad when there is a security admin (you) needed to controll other admins. Do they know what what they have to do or is there maybe a conversation with the supervisor needed?   As mentionned by @OtakarKlier you can configure alert emails when someone changes the configuration or limit these alert emails to the commit-log-events. This way you know at least when someone changed something. And as you then directly have the timestamp you can probably check the config logs more easily and find out what they changed.   You may be also want to try a script that automatically pulls the config logs hourly/daily so this saves your time with the manual config-log-export-task. ... View more

@cengasserwrote:  'Reason: remove previous login' This simply means that there still was a GP session which did not disconnect properly and also did not reach the configured timeout, when the firewall would remove a session without traffic. As mentionned by @Mick_Ball there was still a user-device-pair session "active" on the firewall so the firewall first has to remove this user-device-pair-login in order to allow a new global protect session. ... View more

@mprintz As proposed by @BPry and @Rags you should change the url category. But did you also filter for the destination IPs of these 2 log entries. As this log shows a threat log entry with the subtype spyware these entries don't necessarily mean that this traffic was allowed - 3 log entries aren't enough to say that for sure. It could be that the antispyware feature logged this but after that the traffic was blocked because of the url not matching your custom url category. (Do you log the theat for TLS evasions? Are these 2 entries such threats?) ... View more