About Remo

@welly_59 My conclusion was that it is an issue when you do not have a next hop IP in the route in windows. On the paloalto it does not matter (or probably it only becomes an issue if you have routed everything through the tunnel --> no split tunneling). So it seems like the issue is related to the way GP configures the routes in windows. But hopefully @BPry has a solution. This would be great 🙂 ... View more

@faizankhurshid wrote: 1- After applying the Qos will it again copy the 'af41' in ESP header, when traffic tunnled through IPSEC VPN? so ISP can also enforce qos based on that dscp code in their network Good question. But I think unlike Cisco this isn't the case with Paloalto.   @faizankhurshid wrote: 2- I do not want to apply Qos on clear text traffic going to internet from same egress interface ethernet1/1. So should I apply 'default' qos profile for 'clear text' or should I have to make one new qos profile say 'no-qos' without defining any class (so all clear text traffic will fall under class 4)? Are you talking about Paloalto-QoS or QoS marking? Anyway to apply QoS marking you simply specify this in the actions tab in the security policy rule and you do not set this option for traffic that shouldn't be marked. QoS could still be applied to traffic (without marking) to slow down exessive bandwidth applications to have enough bandwith for your s2s vpn for example.   @faizankhurshid wrote: 3- For the traffic (marked with 'af41' comes from sites to HQ), how to apply the qos with same requirement of match with 'af41' then set priority 'real time' Where I need to apply Qos profile? In your QoS policy you could create a rule to match af41 and then set a specific class for which you configure "real time" in the QoS profile in the network tab and apply that profile in the interface QoS traffic in the direction you want to set that.   ... View more

@BPry How did you manage to get the windows store working when connected with global protect? When GP isn't connected there is no issue with the store but as soon you wan't to open the store with an established connection it won't show anything (GP 3.0, 3.1, 4.0, 4.1) ... View more

@Sanssj In this case you need a good naming concept for AD groups, so you could specify a simple LDAP filter to import the required groups ... or a little more complex LDAP filter. But this is probably the only way ... View more

@welly_59 You were already at the right place of the configuration. With the internal host detection the client first tries to resolve the entered IP address. If the IP address resolves to the configured domainname the the client assumes it is in the internal network. After that the client takes the configured action: if an internal gateway is specified a connection is set up to this internal gateway (normally only for user-id of sending HIP information). If you dont have an internal gateway the client simply doesn't do anything while staying internally. ... View more

 @cwarren5012 You have two possibilities to do this: Custom URL category: in a custom URL category you add an entry like that "storage-ec2-*.sharefile.com". The little disadvantage of this is that the wildcard stands for everything and not only numbers from 000 to 999 Custom App: with a custom app you could exactly configure the URL to match the required URL and then add this app to your policy to allow the access for your company ... View more

@Radmin_85 Was this ASA to PA migration a 1:1 migration or are there little topoligy / routingchanges? The skype telated DNS entries are also sometimes leading to problems. For example some time ago I was troubleshooting a situation where skype calls/conferences to external partners simpliy did not work and as always everyone thought the firewall is the problem ... till we found a wrong DNS entrie which made the clients in the internal network think they are external, so skype was trying to connect to the external IP of the skype edge server where the result was the connection did not work ... after the DNS entry was deleted (this one should only be available from external) everything was working fine ... ... View more

@JoeAndreini wrote: Keep in mind, the firewall does not monitor every group in the domain, only those it is configured to. ... if you restrict the monitored groups with an ldap filter or specify them one by one in the group mapping settings 😉 ... View more

@AKabary You only need one QoS policy. This one policy will assign client-to-server and server-to-client traffic to the specified class. And based on this class you can then specify the bandwith/priority for upload and download seperately as already mentionned and explained by @BatD ... View more

About that what I wrote about the script ... the dame is also possible in excel when you export sll the login and logout events. ... View more

@bhakti1213 If you are already using some sort of snmp monitoring software, then you may be able to gather the required information there. Paloalto has an snmp OID for concurrent global protect connections. Obviously not as simple as generate a report in the UI, but may be this is a doable alternative for you. (If needed there is a lot of good and also free software out there to do this)   As already mentionned by @BPry, you could script this ... a script that pulls the system logs and then analyzes these logs. Start with a concurrent session number of 0 and with every successful login log you increase the number and save it along with a timestamp to a file. The same of course also with logout logs where you decrease the number. In the end you have a file with a lot of timestamps and the number of concurrent global protect connections which you could nicely import to excel and greate a graph with that to visualize the concurrent connections. ... View more

Hi @welly_59   Do you also plan to implement an internal gateway? In the root CA cert it does not really matter what you enter as CN. This cert you simply need to install on your computer. As portal and gateway cert you then you need to create another cert which is signed by the previously created root CA cert. In this cert I would use the FQDN or IP of the portal and gateway. Make sure that you also add the same as SAN (server alternative name) to the cert when you create it. For the management interface cert I recommend to use a different cert than for portal/gateway.   Hope this helps, Remo ... View more

@Victor.Newsom In the past I evaluated a RADIUS MFA software but decided against this one ... Anyway do you have any problems setting this up? Because Azure MFA can be used as standard RADIUS server this should work without problems. ... View more

@_slv_you know that PAN-OS 5 is end of life since november 13, 2016?   So I will try to make it work on PAN-OS 8 but I think the only way for you is upgrading? (On PAN-OS 5 the required jquery Javascript library is probably too old for my proposed solution) ... View more