About Remo

Hi @Amin2  Generally Prisma means a cloudservice by Paloalto. So in this case here Prisma SD-WAN is the SD-WAN technology (formerly Cloudgenix which was aquired by Paloaltonetworks) based on ION devices. These devices are configured with a cloudservice from Paloalto. To these devices you can connect various WAN links like MPLS, LTE and so on. By policies configured in the cloud the best path will be chosen for specific traffic to be sent to your main datacenter where you need an ION-7000 or ION-9000. These ION devices are only for the SD-WAN part. They also analyze traffic to forward it to the right configured path but these are not actual firewalls. Paloalto SD-WAN is SD-WAN for Paloalto firewalls. So in addition to the best in class network security that you get with a Paloaltonetworks firewall, this subscription also enables the SD-WAN technology where you can add different WAN links to the firewall and configure them to be used all at the same time for different types of traffic including the dynamic setup of VPN tunnels (like with the ION devices) between your locations. The configuration of the Paloalto SD-WAN is not done locally on the firewalls or with panorama and not with the cloudservice. ... View more

Hi @ChrisIsett  What PAN-OS versions do you have installed on all these firewalls and are all the same firewalls or different ones? Do you monitor all these firewalls the same way? ... View more

Hi @santonic  As far as I understood, this is not possible. There is only the decrypt-port-mirror-feature on the firewall which allows you to forward decrypted traffic over a mirror port on the firewall. ... View more

Paloalto does it's analysis of the traffic atream-based and not with store-and-forward-method (like almost all email gateways operate). In short, no, unfortunately this is not possible to retrieve the file. ... View more

One one side I fully agree with @reaper , but on the other side we are talking about a security device and an uptime of 300 days also means 300 days without OS updates or fixes for vulnerabilities ... ... View more

@Stribnet you could ask your SE about that to have a feature request created. Maybe there is already one, so you could add your vote to it. ... or as this is not working properly, you could create a TAC case to hopefully find the reason why the existing features aren't working with zoom. ... View more

Hi @Metgatz  How does the routing table look like when you are connected with global protect? ... View more

What about the information that is available at https://<panorama>/api? ... View more

In addition to what @LAYER_8 already wrote. From a dataplane interface you cannot connect to the management interface. Dataplane and management plane have separated routing tables. You can access the cli/webui over a dataplane interface by configuring an interface management profile. But in an active/standby pair this way you will be able to access only the active firewall.  The service routes are used if you want to send some management traffic out of another interface than the management interface (for example that the firewall connect to the update servers directly from the internet facing interface). In an active/standby high availability pair not everything is synced. All the configurations that are not synced you can find here: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/high-availability/reference-ha-synchronization/what-settings-dont-sync-in-activepassive-ha.html ... View more

@SebRupik is absolutely right. If you do not need any features from 10.0 then I recommend to wait at least until x.y.8 or even x.y.9 release. Prior to that I normally don't even consider upgrading to the next version. I had too many problems in the past when I upgraded production firewalls prior to these minor versions. Of course it always depends on which features you use but in general the risk of hitting a bug isn't worth it unless you really need a new feature. (If you have a lab environment where you can test everything - and I really mean everything with not only 1 or 2 users, then you should be able to reduce the risk of problems) ... View more

And you did allow this application in the policy? If yes, then I would change your setup a little bit - at least for troubleshooting. In your existing rule add the custom URL category directly to it instead of the url filtering profile. As URL filtering profile you add temporary one that has everything set to alert. Create a second rule where you configure again the alert-all URL filtering profile and do not specify an URL category directly in that rule This way I assume the access will work and you will see in the URL logs which URLs are missing in your custom category. ... View more

When you check the logs for this connection, does it hit the security policy rule where you added the custom url category? ... View more

Hi @thomas.rogers104  Did you add all the urls from that url in your first post in this topic? Including login.microsoftonline.com (which probably is the most important one for the login)? ... View more

Hi @ColinT  If the cloudprovider does not publish any IP addresses you could create a custom URL category which contains *.netsuite.com qnd add this custom URL category directly into the security policy rule (this does not require URL filtering subscription). If this cloudservice is hosted maybe in another cloud like goole, azure or amazon you could further restrict the access by adding the IP addresses of this cloudprovider - even if these are many IP addresses, it's still better than allowing every IP in the internet. ... View more