About Remo

--> https://www.paloaltonetworks.com/documentation/80/globalprotect/globalprotect-admin-guide/authentication/about-globalprotect-user-authentication/how-does-the-agent-or-app-know-what-credentials-to-supply/cookie-authentication-on-the-portal-or-gateway   The article explain the use of cookies for authentication override and the general purpose of these. The time these cookies are valid can go up to a year but if you only want to improve the user experience while maintaining a secure as possible authentication you should configure the lifetime to only 1 minute. This way the cookie can only be used for this one minute and connection attempts after this minute need to do again the full MFA authentication.   Hope this helps. ... View more

Hi @MP18   This would give you the possibility to assign different authentication profiles for portal and gateway, but as you are using the same one for both, it makes sure that users alwaya have to login with MFA (just in case the access to the portal isn't possible for whatever reason). In this situation with a not working portal the GP clients will try to connect ditectly to the gateway. So you have now secured the access with MFA, but to make the login process for the users a little easier (so that they don't need to log in twice for establishing the connection) you should configure authentication override with a cookie lifetime of 1 minute. This way when everything works as expected a user is required to do the MFA authentication only once.   Regards, Remo ... View more

@MP18 wrote: So do you mean these drops is for traffic that is not allowed. Most of them, I would say yes. For more details @Raido_Rattameister already wrote all the commands you need. ... View more

@TLineberry Ok, that's a reason. Back to what you were asking, as also other software will need more ressources with v3, I think you should give PRTG a try: this software is able to do really a lot more than simple snmp queries (in case you need it sometime), nice design, easy overview over all your sensors, good reporting features, Map feature that allows you to create custom views for an even better overview (for example with your existing network layouts as interactive Map that shows you statusvalies of your devices and it's cheap compared to others.   Of course there are also good opensource software out there that you can get for free, but here others can maybe tell you more ... theres just one software that I remember that really does a great job in this category but does not look as ugly as most of the others ... and I hope I can remeber the name again ...  --> https://github.com/netdata/netdata ... View more

This could be one of the following: Your QoS rule does not catch all http-video traffic (depending on how you created it (source/destination IP/zone...)) It is a long living http-video session that existed already before you created the QoS rule ... View more