About Remo

Hi @pomologist  According to these screenshots I assume the problem is your authenticarion profile. There is a dropdown field for "Type" where you need to choose local database to tell the firewall the source of your users. After changing that, global protect should ask you for username and password. This should work also without specifying a username attribute in the certificate profile. ... View more

Hi @JulianH  There is no recommended maximum for subinterfaces. There are only the specification max numbers for interfaces and subinterfaces which are the following for a PA-3220: 802.1q tags per device 4,094 802.1q tags per physical interface 4,094 Max interfaces (logical and physical) 4,096 As these interfaces are used in PAN-OS to decide where to forward traffic and this is all done in hardware you will not see a performance impact even if you go way above your currently 20 subinterfaces. I personally did not use the interfaces until the specified max so far but at least with more than hundret subinterfaces the firewall forwards the traffic as if there would be only one or two interfaces. Hope this helps, Remo ... View more