About Remo

For example, if you have one portal and two or more gateways. The different gateways you have to access different networks or to apply different security settings. May be gateway 1 is for employees of other companys to support different systems in your network, here you want to enforce 2-factor-authentication. Gateway to for internal employees with corporate computers with client certificates and in addition to that standard LDAP auth to enable a seamless user expetience. And gateway 3 is for admins to access some management systems so here you want to have a certificate profile and 2-factor-authentication enabled. So to manage all these settings with only one portal you have to configure the portal with different settings than the gateways, because the external support employes probably do not have a client certificate from your vorporate PKI. ... View more

@Raido_Rattameister I also run different portals/gateways on loopbackinterfaces ... but I do not NAT at all in this case. All the loopbacks simply have public IPs so there is no need for DNAT ... View more

In order to do url filtering you need to block application quic or allow web acces only on 80 and 443/tcp. Quic is a relatively new udp based TLS protocol and so far it is not possible to do tls decryption on this udp based connections. So paloalto is only able to see this application, but thats all. ... View more

With global protect(PAN-OS 8.0.x and GP 4.0.x) you'd have the ability to install a root CA in the clients trust store ... also on non domain joined computers.   But in your case, the only way is that your users install the cert on their own ... View more

Thanks for the update. Are there any informations about when 4.0.3 will be available? ... View more

Do you have threat prevwntion enabled? ... View more

@MOsama Are these non domain joined computers only windows and are you also using global protect on the non-domain joined devices? ... View more

https://FIREWALLNAME-OR-IP/api/?type=config&action=get&xpath=/config/predefined/threats/vulnerability   But if you are already on 8.0 this works only with 8.0.3. In the other 8.0 versions there is a bug, so CVEs are not shown there. ... View more

On https://threatvault.paloaltonetworks.com is a searchable database of all the different signatures ... only metadata and not, as you already expected, the details on how the signature actually looks like that is used in PAN-OS.   For your first question: It is possible to pull a signaturelist including CVE numbers over the PAN-OS API ... View more

Hi @gustavosj   This topic was already discussed a lot here. In some cases there are solutions and (unfortunately) in other cases there is almost no way to do everything completely transparent to the user. So lets try it this time with your situation 😉 But before we recommend you something that does not apply to your environment, I kindly ask you to answer these questions: Does this dialog only appears in case of connection problems or also right after the installation is complete? What PAN-OS version do you have installed on your portal and gateway? As you specified pre-logon, you already use certificates, right? User or client certificates? What additional authentication are you using (ldap, radius, ...)? You're trying to hide everything completely from the users eyes, so I assume you aren't using any multi-factor-authentication? (TOTP, SMS, ...) What GP agent version do you use? Does your company already have a SAML IdP infrastructure (e.g. Microsoft ADFS)? ... View more

Besides the fact that there seems to be a bug: Is this a real problem? Wouldn't it make more sense to only enable TLS1.2 as there are almost 0 clients that stop at TLS1.1 and do not support TLS1.2 ... View more

You could try to "uncheck" 3DES from the CLI, maybe this works (if it is a bug in the webUI. ... View more