About Remo

Remo · ‎08-17-2018

@Stephen.Davis If you do not need the captive portal you could reuse this response page to redirect the user to company.gpcs.com. Simply place these line in the <head> section of the captive portal tesponse page html: <script> window.location.href = "https://company.gpcs.com"; </script>

Remo · ‎08-17-2018

@Retired Member Thanks for the information. This should be plenty of time to update to 8.1 ... at least for all who keep their devices up to date 😛

Remo · ‎08-16-2018

Hi @lchan2550 From clients to the ESM you only need port 2125/tcp (or whatever port you configured if you changed the default port. For the Traps admins you also need port 443/tcp to connect to the webinterface.

Remo · ‎08-16-2018

Hi @KumarRamalinga With a custom report you will get at least close to that what you need. There you should add the columns you need, set the group by field to source IP and the sort by to bytes. This should generate a report with your requirements.

Remo · ‎08-16-2018

@Michael.Thyme I understood how you want to use the two authentications of the portal and gateway and I wrote of low chances because it might be possible that somehow the process for the portal could have a problem while the gateway still works properly. Ok, the propability is extremely low, but in theory it is possible. I also read some things about the google_authenticator pam module and I came to the same conclusion as you: without some rewriting of the module it isn't possible that this authentication module will be access-challenge compatible. LinOTP is a very good idea I think. This way you will be able to configure the login flow in the LinOTP application (and in addition this software gives you way more possibilities about other configurations, user self registration, logging, ...)

Remo · ‎08-16-2018

@jsalmans I wrote about 3 rules because you said something about allowing specific destinations with FQDN objects. If you are talking about external websites then of course add them to a custom URL category and allow these websites in the URL Profile for these students. As you said, this way you need 2 rules and you're done 😉

Remo · ‎08-16-2018

@aleksandar.astardzhiev wrote: - Your Panorama is VM-Series? And Not physical appliance? Yes, Panorama VM running on Hyper-V (but on ESX the features of Panorama are the same) @aleksandar.astardzhiev wrote: - You are running 8.1? Yes, 8.1.0 @aleksandar.astardzhiev wrote: - You are running in panorama mode? Yes, Panorama Mode.

Remo · ‎08-16-2018

Hi @aleksandar.astardzhiev Thats how it looks like on my panorama with PAN-OS 8.1: I know dump question, but did you accidentilly downloaded the 8.0 ova template? Anyway with PAN-OS 8.1 multiple interfaces on a panorama VM are supported.

Remo · ‎08-16-2018

@jsalmans If there is a way to avoid *.* URL entries then you should. So definately go with the way that you change the URL block page based on the <rulename/> variable. In addition I would recommend you to create 3 rules: Allow rule with the allowed destinations for these students Allow rule with a URL filtering profile applied where you set everything to block (Depending on the rest of your policy) Deny all rule to make sure that these students cannot use something else to somehow pass traffic through the firewall

Remo · ‎08-15-2018

@jsalmans If there is a rulename variable, even better. Good to know 😉 But regarding the other possibility with the wildcard custom category: Just make sure that the action of this category is set to "none" in your other profiles, so that this category will have no effect there.

Remo · ‎08-15-2018

@jsalmans Thats the point where I am not 100% sure if the wildcard behaves the same as "normal" entries. I am pretty sure that it will be like that but I haven't done this so far. We only use a custom category shared over multiple firewalls when we want to block something in general. At least there it works that the custom category has always the higher priority than builtin categories.

Remo · ‎08-15-2018

Hi @jsalmans Do you already have the application block page enabled? If not, one possobility would be to use this response page and change this one to the specific content you want to show these students. With this method you should - as you proposed - two security rules: one with either addressobjects or a custom URL category attached directly to the rule and another rule that blocks everything else for these stutents and where it is possible (http traffic) the firewall will show the application block page. The other possibility would be to dynamically change the URL block page based on the sourceuser. The big disadvantage of this solution is, that you need to specify the sourceusers in the block page in a little part with javascript to be able to change the content for different users. And another possibility I can think of is, if you specify a custom URL category with *.* as content. This custom category you add to a dedicated URL profile for these users with the action block and allow for all other categories. This way you should be able to change the content with javascript ob the blockpage based on this custom URL category and this will allow you to "easily" achieve what you want without changing the block page every time when there is a userchange in the AD group. So I personally would try the last possibility in my post and this does not work for you the first one. The second one works but is ... not so good 😛

Remo · ‎08-15-2018

@BPry I admit, I never configured it with 10 addresses. But when I used a /24 or /25 as source IP and the same network size as source NAT, the last octett remained the same.

Remo · ‎08-15-2018

@nson2139 Maybe I do not understand your question, but as long as your effective source and your source NAT IP range are the same soze, then you could use static NAT...

Remo · ‎08-15-2018

Basic setup for the first PA-220 (MGMT Interface, Licenses, Dynamic Updates) Export the config from the PA-200 and import it to the PA-220. Before you commit make sure that you change the mgmt IP to the one set in step 1 (so that you don't have two devices with the same ip) Set up HA on the first PA-220 Set up HA on the second PA-220 Do a configuration sync from the first to the second PA-220 ... and you should be good to go to replace the PA-200 with the PA-220 cluster (this assumes that you will use the same dataplane interfaces on the pa-220 as on the pa-200)

Member Since	‎03-20-2013 04:23 AM
Date Last Visited	‎11-26-2025 01:29 PM
Posts	2,247
Total Likes Received	806

Online Status	Offline
Date Last Visited	‎11-26-2025 01:29 PM

About Remo

Re: Certificate Expired Warning in Deploy but all certificates are good

Re: How to request a URL filtering change to High-Risk?

Re: Template vs Device Group

Re: sorting question

Re: Panorama Disk

Re: Cortex XDR on Citrix non-persistent multi-user server

Re: Bad support from plaoalto

Re: Activate Firewall with Expired License / Unknown Auth Code

Re: Wait time

Re: Cortex XDR on Citrix non-persistent multi-user server

Re: Active-Passive pair takes long to show the status when one is rebooted.

Re: sorting question

Re: Deal Registration End Customer Details not Include

Re: Enable Qos on sub-interface

Firewallcrash because of Application cloud Engine (ACE)

Re: Admin console unreachable/cant remote in or ping - PA support wont let you submit a ticket without a TSF file - which you get via admin console

Re: How to request a URL filtering change to High-Risk?

Re: Log Container Page Only - impact?

Re: Stop wsc files

Re: Customer Support Portal error

Nominated Discussion - Sorting Question

Nominated Discussion: URL Filtering in TLS v1.3

How to Add Log Forwarding Profiles in All Security Policies

Re: Redirect Users to GPCS Portal for Agent Download

Re: Software End-of-Life policy vs end of support

Re: Best practice wise, which ports do we open on our AWS instance for our TRAPS ESM Server?

Re: Top Talker/Conversation in Paloalto 5220

Re: Global Protect do not ask for OTP

Re: Blocking Access for a User in a Specific AD Group

Re: Panorama VM-Series Multiple Interface support

Re: Panorama VM-Series Multiple Interface support

Re: Blocking Access for a User in a Specific AD Group

Re: Blocking Access for a User in a Specific AD Group

Re: Blocking Access for a User in a Specific AD Group

Re: Blocking Access for a User in a Specific AD Group

Re: NAT allocation during a pool configuration.

Re: NAT allocation during a pool configuration.

Re: Migrating from PA-200 to 220 with HA

Seattle Beta - GlobalProtect (ELK)

Unlock your full community experience!

About Remo