About Remo

@CharlieG wrote: Dude - brutal 🙂   That said, if I can ping the server supplying the share, and query it for things like SVN and RDP, there is yet another layer of protocol for the share?   Okay, I'll get them to look at the logs.  They don't seem to be excessively engaged 🙂   thanks From you description I assume the global protect configuration is set to "on-demand" so we can exclude the possibility of a policy problem with the pre-logon user. As you can ping and connect to the server I would also say this definately isn't a global protect issue - but this you could verify with a tcp connect to port 445 when you aren't able to open the share.   Do you have offline synced folders configured for this share? ... View more

Hi @Alex_Samad    You could give it a try with a special group mapping settings profile wher you set the object class to computers instead of users: ... View more

I haven't try this so far, but technically it should be possible ... also with some limitations probably. With panorama you are able to configure the devices of this a/p cluster independently (use template variables to be able to still configure as much as possible only once). Even if you configure different networks/interfaces for the two devices you can configure the same policy in one device group. Depending on the actual network configuration you can even use one NAT rule for the internet access. Here is also a limitation I can imagine: I don't know if the session sync properly works in an a/p cluster when there are different hide NAT addresses. ... View more

Hi @mjanik01    In panorama there is an option called "Share unused address and service objects with devices". If you disable this option panorama pushes only the required objects to the firewalls. --> https://docs.paloaltonetworks.com/panorama/8-0/panorama-admin/manage-firewalls/manage-device-groups/manage-unused-shared-objects (This requires that you also manage the policies in panorama and not only the objects because only this way panorama is able to know whitch objects need to be pushed) ... View more

Are the firewalls managed by panorama? ... View more

@nextgenhappines  Maybe this one? https://live.paloaltonetworks.com/t5/Community-Blog/PAN-OS-8-1-2-introduces-new-log-options/ba-p/217858   ... View more

@jeremy.larsen wrote: configure delete rulebase security rules rule1 delete zone trust delete zone untrust delete network virtual-wire default-vwire delete network interface ethernet ethernet1/1 delete network interface ethernet ethernet1/2 delete network virtual-router default Since I started working with PaloAlto Firewalls this has been the first thing to do after unboxing 😉 ... View more

Hi @mkopcic    This is only a one-way sync from panorama to the firewall. So no adding a route locally on the firewall will not show up in the panorama config. ... View more

@kiwi  Could you tell me/(us) the FR IDs? ... View more

@OtakarKlier wrote: There is no reason to have these on deny rules as they wont give you any real info (since they are denied). That's what I actually meant with my question 😉   @OtakarKlier wrote: Also thye will just eat up CPU. I only put security profiles on allow policies. This one I think is partly true. The session will be denied based on the security policy criteria. So for example if there is a deny rule based on zones, IPs and/or ports there won't be anything left that can be processed by the content processors (FPGAs). If you have a deny rule based on applications then there will probably some packets that can be checked with secueity profiles.   ... View more

Hi @JohnJones   Are you sure that you have URL logs from rules that have the another action than "allow"? ... View more

@Brandon_Wertz  Yes, you are right. When setting this value to 0 then this is correct, but this results (in the situation of our customer) that also in short connections losses the user has to log in again using MFA. Because of that I created this feature Request so that after short connection losses (for example when a user works in a train) the connection restoration is possible but still GP does not reconnect when changing from external to inernal. ... View more