About Remo

Hi @BrianRa   Could you share some more details why it does not fit in your environment? Your drive encryption software uses its own credential provider right? So you have set this credential provider as default credential provider at least in windows 10? In windows 8 it is (unfortunately) somewhere between diffcult and impossible to set a default credential provider. And windows 7 is completely different, there your only chance to set a "default" is to hide all others. Or could you share how you did your tests and what the problems were? Another possibility is may be to user GlobalProtect with SAML, which then obvisously requires an SAML IdP or ADFS Server.   Regards, Remo ... View more

this could be difficult. Right now you already downgraded once, so the firewall changed to your backup partition where 7.0.x was installed. Now the backup partition still contains 7.1.x. Probably not the best idea (in your very special situation) was downgrading to 7.0.1. It may be is a bug in 7.0.1. what you could try next: reboot and try to download/upload 6.1.0 again install 7.0.16 and then try again to go back to 6.1.x   PS: I don't know if such a downgrade marathon will work properly 😛 ... View more

Hi @DKanta   May I first ask you why you want to downgrade to 5.0.x? 5.0.x has reached it's end-of-life date on november 13, 2016. https://www.paloaltonetworks.com/services/support/end-of-life-announcements/end-of-life-summary   Regards, Remo ... View more

http://www.thewindowsclub.com/assign-default-credential-provider-windows-10 ... View more

The other option I can think of is placing the steelhead appliance in front or behind the firewall. This way ALL traffic would pass the steelhead and then you could create pass-through rules on the steelhead for traffic you do not want to optimize. I still think the option with the PBF Rules ist the best one and it gives you great flexibility and control while allowing a simple management of the traffic you need to have optimized by the steelhead. ... View more

I've opened a TAC case to find out what's going wrong here. Will get back with an update as soon I have new informations. ... View more

@Brandon_Wertz Thats how I was expecting the log should look like. But at least on 8.0.2 other logs exept the traffictype:deny-action:allow are missing.   Edit: One cluster was updated on saturday from 7.0.x to 8.0.2. Since then it started with these missing logs. On 7.0.x I haven't had such logs at all with these type/action/session-end-reason --> So it could be a bug of 8.0.2 ... View more

2 cluster have the same versions mentionned by @Brandon_Wertz installed and 1 cluster has app&threat 708-4066 and av version 2278-2766 installed.   @Brandon_Wertz Of coulse it could be absolutely normal ... but when I read the first post on this topic and then checked my logs I thought there should be another log (url/threat) which indicates the reason of this "policy deny" ... View more

Today we also found a lot of these entries on our firewall. The strange thing is: its exacly this log entry as on the screenshot from @nikoo, no url log, no threat log ... nothing. Only this type deny log with the action allow and the session end reason policy deny   Edit: I have now seen these logs on 3 different hardware series running 8.0.2. So the only thing I know, it is not hardware related ... View more

For me the templates and template stacks are already a great feature. Specially with PAN-OS 8 where you're able to create even more of them (which helps a lot when you manage a lot of firewalls with one panorama)   But ... I agree with you. It would be even better with a hirarchy like in the device groups ... View more

FYI: Probably not that important on a PA-220 but LACP prenegotiation is not supported on this platform (the same as with the PA-800 series) ... View more

Hi @mtsujihara   I don't know it this user-group-mapping fof SAML users is possible. Probably not because the default group-mapping in the WebUI requires an LDAP profile. But may be you should give this a try for the creation of groups and containing users: https://www.paloaltonetworks.com/documentation/80/pan-os/xml-api/pan-os-xml-api-request-types/apply-user-id-mapping-and-populate-dynamic-address-groups-api ... View more