About Remo

@Brandon_Wertz  That's a good one! ... View more

@Brandon_Wertz wrote: @rclark wrote: Yes you can.   You can use the block page to run a script that will re-direct the traffic to another site.     Isn't that what @Raido_Rattameister already commented above?   "Theoretically you can also do some tricks with response pages and Javascript redirect but this is quite hack already." With this "hack"/javascript on the response page you can do great things: URL redirects and even specific redirects based on categories or specific URLs Different response page content based on sourceuser/URL category/website Display the response page in different languages based on the users browser langiage settings Redirect any access to the RP to a custom webserver and pass along all the attributs like user, category, ... to do some more statistics there (requires custom webserver implementation) Create a form on the RP where a user could directly open a ticket in case of wrong category (requires jquery) ... ... View more

@Raido_Rattameister wrote: No.   You could use DNS Proxy feature and static entries. In this case you point your client device DNS settings towards Palo (usually with DHCP). Set up DNS Proxy to pass on DNS requests to DNS server of your preference. And add static entry so that if user asks for www.bing.com Palo will reply with IP of www.google.com This will end up in certificate warnings and maybe even worse in completely blocked access because of hsts and other https security features. ... View more

Did you find these on your 5260 PoC box? If yes, then these are probably configured by the admin that was able to play with this monster prior to you 😉 ... View more

--> Global Protect 5.0.2 ... View more

@DShofkom33xif you want to control webtraffic then you should still follow the recommendation of PaloAlto and block 443/udp. So far I have not heard of any plans that this traffic can be decrypted or properly identified. ... View more

I have 11 open cases about global protect right now 😛 One of them is about the issue you mentionned. Just wait a little longer... ... View more

Hi @SteveMcBride    What GP version do you use? How does your GP setup look like (on-demand/pre-logon/user-logon, is SSO enabled ...)? Does your ISE forward the access-challenge packet to the firewall? Depending on your actual configuration this should work with MFA.     ... View more

Hi @karthikeyanB    This needs to be done with API calls, as the snmp OID for the tunnel interface is always in state "up". It is also possible if you send snmp traps from the firewall to the monitoring server with the informations about the tunnel going up/down. ... View more

@AAT  No, GP does not provide an API to automate such things. But the problem you are talking about sounds like a bug of GP. Which version do you use right now? ... View more

... or (source/member contains '192.168.1.0') and (service/member eq 'service-ssh-tcp-22') ... View more

Got it. You are probably right that this is not possible so far. I also played a little with PBF rules but I either end up with the same problem or some other limitations (for No-PBF rules it is not possible to configure a monitor IP).   @El-ahrairah wrote: This is confirmed if you A - check the status directly after a commit and B - performing a tx PCAP reveals ICMP requests going out of eth1/1. This is ugly but what is R1 doing with this route monitor ping? Could R1 send back the ping to 2.2.2.2 out of the same interface where it received it and then the ping goes through the PA to R2 and then the way back to 1.1.1.2?  ... View more

Hi @karthikeyanB    So far PAN-OS 9 is still to new to have a recommended version by PaloAlto TAC. In march 2019 the recommended releases are: 8.1.6 , 8.0.15 and 7.1.22. Do you need all the address objects or could it be that a lot of them are unused?  ... View more

This is also the case if you do not specify an interface in the static route? And maybe even choose the IP 2.2.2.1 as source? ... View more

Yes, your traffic will be  served first. But with this confoguration it is possible that you consume all the bandwidth and nothing is left for your tenant(s) ... View more