About Remo

So you doublechecked that this one user is configured in the authentication profile (or then set to all users) and the same in the global protect portal agent configuration? ... View more

Hi @jeff6strings  First to your last question: yes, there were major changes in dns behaviour. So depending on the configuration of the anyconnect vpn, this might be possible that this does not work if both vpn clients are active. Do you have details about the configuration of the anyconnect firewall? Is this client also pushing dns servers to the computers? Did you try to change the setting "Resolve All FQDNs using DNS servers Assigned by the Tunnel" to no to check if this makes any difference?   Might be a dumb question: but on the firewall where you configured the webex exclusion, you have the global protect subscription right?   Regards, Remo ... View more

Hi @pomologist  Are you the only one who configures thisbfirewall or did maybe another admin change something? Is there something in the config log? Specifically related the not autorizes message: is there a specific group or user configured in the auth profile or in the global protect agen configuration? ... View more

Hi @MPESDC  This is a special case for the application ftp. In an initial ftp connection the actual data transfer port is sent in the payload of the controlconnection. The firewall reads this and opens the additional port dynamically. This is at least the explanation for this behaviour so far. I see it here probably as you do. If you have specified exactly one port, the firewall should not allow dynamically another one - even if this breaks the ftp connection. In this situation I recommend to open a TAC case for either finaly clarification or informing them about this behaviour. ... View more

For the firewalls this would be the recommended version too, but install the upgrade first at least on panorama. ... View more

@BigPalo sounds strange 😛 Prior to waisting time with troubleshooting I would recommend that you upgrade to the recommended version of PAN-OS 9.0 which is 9.0.13. The list of fixes which were implemented between 9.0.9 and 9.0.13 is almost endless, so the chances are good that this restart no longer happens after the update and if it still does, then troubleshooting this problem will make sense. ... View more

Hi @BigPalo  What are you doing with the panorama prior to the restarts? ... View more

Hi @MatteoTonin  In this case you should take a closer look at the global protect agent logs to check if there are any errors or other indicators that show why the connection fails. Specially at the times when you expect a connection should be brought up. With the versions you use I can confirm, that it works that global protect will establish a connection. As written in the documentation, with always on this also works no matter how long there is no internet connection available. ... View more

Hi @akshayhariRajan  No, file hashes that you use to create IOC rules are not automatically blocked. To block file hashes you need to use the block lists: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/investigate-files/manage-file-execution.html ... View more

Hi @raufuddin  Please take a look at Palo Alto Networks Ultimate test drive: https://www.paloaltonetworks.com/resources/test-drives There you will get hands on access in guided workshops. For an evaluation or a demo in your environment you need to contact Palo Alto Sales. Open this website and scroll almost to the bottom to schedule a demo: https://www.paloaltonetworks.com/network-security/next-generation-firewall ... View more

Connect with SSH and type the following commands: configure show shared certificate   Whis will show the currently configured certificates. ... View more

After generating the certificate, did you check on CLI if the cert is there? When you say it works when you import a configuration, do you import there a full device configuration - with a certificate - or only a partial configuration? ... View more

Hi @chupapi  The link @MP18 was talking about was in his previous comment. Here it is again: https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-p/258304 ... View more

Hi @dwi.nur  After creation, did you see the message that the cert was created successfully? (Successfully generated certificate and key pair...) Did you maybe create the certificate in a specific vsys and it is not showing in another vsys? What PAN-OS version do you have installed? ... View more

Are you talking about this logmigration? --> https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/set-up-panorama/install-content-and-software-updates-for-panorama/migrate-panorama-logs-to-new-log-format.html ... View more