About Remo

@raji_toor And you probably need to configure the internal IP of the meraki-device as remote identification on your firewall (or use a completely different ike identifier or the public IP on your meraki as local identifier) ... View more

Is the portal and gateway on the same firewall and IP address?  Is there a problem with the certificates on your portal/gateway (revoked, expired, missing root cert on your computer,  ...)? ... View more

Hi @en26bq   My initial question was a little sensless. It would matter if you have both internet connections on the same port but different subinterfaces on you PA...   Anyway, when you create the QoS configuration on your internal interface, in the clear text tab you can create different rules with different QoS profiles based on the source interface (or the source IP) of the incoming traffic.     ... View more

Hi @en26bq   On what PAN hardware do you need to set this up? ... View more

@BPry wrote: @Remo, Since you are setting the GlobalProtect redirect flag you won't be able to actually get to the client download package, that redirect will force you over to the server that you set and that's where the Captive Portal piece comes in to actually get this to work.  True, I somehow missed this point 😛 But this solution will force users, who connect first to the GP Portal, to log in twice - because the ip-user-mapping is not created when a user logs in to the GP Portal ...   I think we see it all in the same way: it is not really a really a problem and definately not a security issue... ... but with the GP Portal login I think that the login should be also required for downloading the software or is there another reason for a GP Portal with login form?   ... View more

Hi @LucaMarchiori   Are you already on PAN-OS 8 and is a temporary block required or is it ok to ban such source IP's? ... View more

Hi @ansharma   But if someone knows the download url, he will still be able to go directly there and download the software ... This is the point in this topic, that the download is available without login - if someone knows the download url - and that the download is still available when the portal is disabled ... ... View more

@BPry It is possible to force a TAC case to be moved to level 2 or 3 after one day? Do you simply need to say "please move the case to the next level" or how does this has to be done? Over your SE? ... View more

@TranceforLife PAN-79780? --> fixed in 8.0.4 ... View more

Where is my live community hoodie? 😛   No, seriously, @KyleVonFange do you have results from your tests? ... View more

Ok I failed to get this done. What I tried: (I know this is really ugly) enable user identification on the Untrust/Internet zone. With this I was hoping that there will be a ip-user-mapping entry after a userlogin to the portal website. Then my plan was to only allow access to the download url for authenticated users. - Result: url filtering is possible but there is no ip-user-mapping I also tried with captive portal. Then my intention was to prepare the captive portal website to look like the GP Portal. And block the access to the upcoming GP portal URL, so I can place a block response page that looks like the GP portal after login. This way I would have a usermapping which could be used to allow only authenticated users to download the software - Result: if you configure a captive portal rule for accessing the GP portal IP --> GP Portal always comes first, captive portal does not show up So you eithe wait for this feature request or place the GP software on your own webserver with either doing the authentication completely yourself on the webserver or use a captive portal rule there so your PA firewall at least handles the authentication/authorization part ...   PS: as I already wrote, when you disable the portal login website completely the download is still available with the direct url ... View more

The solution is pre-logon.   Because the client does not have access to any ressources (including dns) it waits and waits and waits for responses ... and then once windows gives up and realizes that it does not have network access at that time and continues with cached ressources ... View more

first results: Wait for the SE to get this implemented the right way ... I'm not giving up, but it at the moment it looks like there are only two possibilitys: it is really not possible or if there is still a little chance, it will be really ugly ...   Right now it is even worse: I am still able to download the client with the direct url when the Login Page is DISABLED! ... View more