About Remo

@markdaniel Even on one firewall you can have more than one global protect gateway configuration. ... View more

With the proposal of @Mick_Ball it definately is possible to have the same IP pool for different client settings. But as @markdaniel wrote there are also different customers on that same gateway so I don't know if it is ok if all these users from different customers are in the same IP pool. Another possibility would be to add multiple global protect gateways - one for each customer or one for clients without pre logon and one for prelogon users. This way everythings can be separated even better. Portal could still be the same for the diffetent customers. ... View more

@S.Cantwell are you talking about the device groups? As these are applied to 0070003242649/VSYSNAME. The templates need to be added to template stacks to which actual firewalls (without vsys) are attached. ... View more

Hi @Sec101  Panorama actually doesn't care about the internal firewall-vsys-names (vsys1, vsys2, vsys3, ...). In panorama you create a template with a name like "VPN". If you then apply this template to a firewall, the configuration will be applied to the vsys with the name "VPN". There it does not matter if this vsys "VPN"  is vsys2 on firewall 1 ond vsys4 for example on firewall 2. So with this theoretically your requirement should be configurable but there probably stilm are some stones in the way aka dependent configurations. So if there are other configurations in the same vsys on the two firewalls you might need to change some of these into the template for the vsys "VPN". ... View more

Hi @Sec101  As long as the name (in panorama) for the vsys is the same, this shouldn't be a problem. Also the certificate then can be imported in this template and is then applied to both firewalls. ... View more

And did you count the profiles by yourself or did the firewall show you 84 or 85 when you get the capacity error? ... View more

Hi @N.Team544522  What PAN-OS version do you use? Sometimes there are capacity changes with new PAN-os releases and the link posted by @LAYER_8 shows the capacity with the newest one. ... View more

With arp I agree (even though I don't know exactly). Maybe also routing protocol traffic is taking that path. But in both cases it wouldn't be as this path is showing. There definately is packet processing involved - simply not the same processing as "normal" traffix has to go through. "Normal" traffic which arrives at an interface and has the same egress interface also is precessed / inspected by the firewall, so - as far as I know - there is no packet in and directly out for such traffic.   Maybe @jdelio or @reaper could add some more information here about what traffic is meant by this direct path between ingress and egress stage? ... View more

@RoutingWithJon is talking about this one here:     Available at https://live.paloaltonetworks.com//t5/image/serverpage/image-id/12862i950F549C7D4E6309 ... View more

Hi @Gareth.Doyle  How does you trust path to the root ca look? Is it root > intermediate > decryption ca? Did you also try to import the decryption ca into the java trust store? And this question might be obvious, but did you make sure to import the CA certs as trusted issuer/CA certs? ... View more