About Remo

Unless you have a lab setup where you can test EVERYTHING that you use in production and also on the same hardware, then wait. I personally wait till at least x.x.7 or even better x.x.8 release (exceptions are on PA-200/PA-220 with only really basic features, there I would also install already x.x.3 or x.x.4 releases) ... View more

Hi @KarthikMuthukrishnan    Does your DMZ server have a private IP? If yes then you need a security policy rule that allows ssh from your DMZ server zone and IP to the internet. In addition you need a NAT rule with the source your dmz server zone/ip as source and the internet zone as destination. In the translated address tab configure dynamic ip and port and interface IP. There you chose your internet facing interface and the corresponding IP.  ... View more

What exactly do you try to configure? Allow sftp from internal/dmz to the internet or from the internet to an internal or dmz server? If from internet, does your server have a punlic or private IP? In order to let the community help you need to give us some more informations about the situation. ... View more

@David_Ball  There were some updates in Content Update version 8129 regarding Azure Information Protection Data Labels: https://downloads.paloaltonetworks.com/content/content-8129-5331.html?__gda__=1552150224_51301373809c2833fb40d4a6912902fa ... View more

@Remo wrote: Added FR ID 9958 - Azure Information Protection (AIP) Tag support for Data Filtering Support was added in PAN-OS 8.0 starting with content update version 8129. https://downloads.paloaltonetworks.com/content/content-8129-5331.html?__gda__=1552150224_51301373809c2833fb40d4a6912902fa ... View more

Updated FR ID 9563 (Configurable Time when Global Protect Captive Portal Notification should be shown). It is implemented in Global Protect 4.1 but requires at least Content Update 8118-5277 on the firewall to configure it. More Information you can find here: Captive Portal Notification Delay ... View more

@hbalzac wrote: 2287 - Not sure the name in PA:s systems. But it is to have a more flexible loopbackfilter (at the moment, you cant have different subnets in the acl for snmp and https for example) Thanks @hbalzac. I have added FR ID to the list. ... View more

From internal to the internet or from the internet to a host in your internal network? In both cases you need a NAT rule and a security policy rule that allows ssh. ... View more

Hi @StevenEerdekens    The public cert is always public available. It is send in every tls connection that you establish to duckDNS. In your browser you can see the cert also when you check the tls certificate of the website. The duckDNS cert is this one here: -----BEGIN CERTIFICATE----- MIIGYDCCBUigAwIBAgIJAOL5nH5b/py2MA0GCSqGSIb3DQEBCwUAMIHGMQswCQYDVQQGEwJVUzEQ MA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2NvdHRzZGFsZTElMCMGA1UEChMcU3RhcmZpZWxk IFRlY2hub2xvZ2llcywgSW5jLjEzMDEGA1UECxMqaHR0cDovL2NlcnRzLnN0YXJmaWVsZHRlY2gu Y29tL3JlcG9zaXRvcnkvMTQwMgYDVQQDEytTdGFyZmllbGQgU2VjdXJlIENlcnRpZmljYXRlIEF1 dGhvcml0eSAtIEcyMB4XDTE4MDUwOTEzNTIxMloXDTE5MDcwODEyNDYwMFowOTEhMB8GA1UECxMY RG9tYWluIENvbnRyb2wgVmFsaWRhdGVkMRQwEgYDVQQDEwtkdWNrZG5zLm9yZzCCASIwDQYJKoZI hvcNAQEBBQADggEPADCCAQoCggEBAK0nsIS1nfeEHQUaax+kNhAA0bZSQ/xCidcm5Xfbj099EUca NbdhdcRHIh9oLa4Sna68Rsfzeyl/sQ5MECjg3dmJ7TvcEXyfEbx2/EAhrMMcisiNIWraGGoA2b24 3y4MMEMy7MAQaMK2FLfele9+Qq4BMIhmo9xfYd7I7QITtBoHufFfuTwq12uUO687kNWHh8dHa7eL REeAgiZaaKfRP5PccfSwZT/LNgHNsk0SjwTVjIChIeWLH4q4wVmSR1NWL5nGsEyLDx0EiB4yDQyI FfBCyCW2tm6cVdIsNlr1WCGcQPbg4CGJSRqkEIqtR2WTrJiZm2/HH2YzzoiPYBHqMtkCAwEAAaOC AtswggLXMAwGA1UdEwEB/wQCMAAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMA4GA1Ud DwEB/wQEAwIFoDA9BgNVHR8ENjA0MDKgMKAuhixodHRwOi8vY3JsLnN0YXJmaWVsZHRlY2guY29t L3NmaWcyczEtMTAxLmNybDBjBgNVHSAEXDBaME4GC2CGSAGG/W4BBxcBMD8wPQYIKwYBBQUHAgEW MWh0dHA6Ly9jZXJ0aWZpY2F0ZXMuc3RhcmZpZWxkdGVjaC5jb20vcmVwb3NpdG9yeS8wCAYGZ4EM AQIBMIGCBggrBgEFBQcBAQR2MHQwKgYIKwYBBQUHMAGGHmh0dHA6Ly9vY3NwLnN0YXJmaWVsZHRl Y2guY29tLzBGBggrBgEFBQcwAoY6aHR0cDovL2NlcnRpZmljYXRlcy5zdGFyZmllbGR0ZWNoLmNv bS9yZXBvc2l0b3J5L3NmaWcyLmNydDAfBgNVHSMEGDAWgBQlRYFoUCY4PTstLL7Natm2PbNmYzAn BgNVHREEIDAeggtkdWNrZG5zLm9yZ4IPd3d3LmR1Y2tkbnMub3JnMB0GA1UdDgQWBBSfTZVAxuqj POjYBMnfDcDzAlhJ2DCCAQQGCisGAQQB1nkCBAIEgfUEgfIA8AB1AKS5CZC0GFgUh7sTosxncAo8 NZgE+RvfuON3zQ7IDdwQAAABY0UtY2cAAAQDAEYwRAIgbZbBehTwoYb3LSH0lQNU7kSXM3UON+WT oJYfI7V4c18CIC2NhgKEtd2n+e+DbFmT7Z0VlUAo4MxuJatcpbAa1nX2AHcAdH7agzGtMxCRIZzO JU9CcMK//V5CIAjGNzV55hB7zFYAAAFjRS1kVAAABAMASDBGAiEA6MmBRVoeb1P4r5rxvteyZ6fn fWMyZmjiwJCpBVT6tEcCIQDgdzI63ntwUh6YNoQsEXAih9v4702plBTk5RymCDM4pjANBgkqhkiG 9w0BAQsFAAOCAQEA2engR6oxMC5KxSYoivchGCsvO956hG6VMe70uaavddgvNYtg6hdkf1JUrSmg t4EURspzaMuNwq9diN9PQHsQyuS1NGqKlJKWqy/CkYfk4BuwL2P0GP/fhwHbFslk9Ebdb3O7+Zrt tbjSVWoxsI+UgD0UfGUEy+5wOnA443QUl9G8lUNZdXdKdBd7s831205nc82KLy8tNuLh3PvXQJff IBqHBbJWnHcxz0MJIWoLx7iDhBYEkQ/qRH5m2uvDDybwICDgd/eY3RuCxt/yZE2Fbj6MZbY+hjOd 57k/kPcAEmUHD8y0i7z3W447+H0gp8IAvkE7u5jB9lNv2PTW5UO5KQ== -----END CERTIFICATE----- But for the cert profile you should use the intermediate cert which signed the duckdns cert.   Hope this helps.   Regards, Remo ... View more

Awful situation that you have right now... what 5000 series firewall do you have running? PA-5020s? ... View more

@mwiadrowski which GP version do you use? If you are on 4.1.x, I strongly recommend to stop further troubleshooting before you have installed 5.0.0. Over the last year I was in the same troubles as you now ... do you have a RADIUS server for MFA or are you using SAML and I assume you have an active directory where the users are stored? I am askong this questions to hopefully give you the correct answer, because now with globalprotect 5.0.0 I finally hive this setup up and running   @Mick_Ball in your setup proposal isn't MFA required also from the internal network? I think I remember this was the reason why I did not use this configurationa ... View more

Besides the fact that the whole trust system of the PKI wouln't work if everyone could sign certs with a publoc key, the money-making machine of the public CA also wouln't work 😉 ... View more

@JoseMatamis wrote: Agent Update 4.1.9 may alleviate this. What  changed in 4.1.9? So far I don't see a difference regarding this... ... View more

@BPry Even 8.1.6 isn't recommended yet, right?   Now with this topic you created (and if we keep replying so that this topic keeps to be on top as I don't think paloalto will make this a sticky topic) I think there will be less "my network is down after installing 9.0.0 - why?"-topics, so I'm gonna say 6 😉 ... View more

Did you configure the decryption rule with any as source IP/zone? Is it really the same session in URL and traffic log? Does the session where decrypted still shows 'yes' hit your decryption exemption rule? ... View more