About Remo

Hi @carterg   Actually there are a lot of variables here that could lead to problems. From your description I assume that your company does use on-demand mode in combinarion with MFA authentication from Okta. Anyway I also see that you use Global Protect Version 4.1.0. At first I would recommend to update to 4.1.1 before you waist time with troubleshooting something that may be already fixed (at least one bug sounds similar to your problem https://www.paloaltonetworks.com/documentation/41/globalprotect/globalprotect-app-release-notes/gp-app-release-information/globalprotect-411-addressed-issues#id184JK06M0Z0 ). The update is a recommendation, what you need to check are the global protect logs on the client for errors and also lower severity entries --> PANGPS and PANGPA Logs. You also mentionned that the problem also exists on older versions: whichbones did you test? ... View more

Hi @TelecoRed   Where did you configure the certificate? Is it in a template in shared context for a firewall or in a specific vsys? And: did you try to create the rule in a device group which is actually attached to a firewall instead of the shared context? ... View more

Hi @Gun-Slinger   Did you test with simply renaming the vsys in panorama and then when you pushed the config a now vsys was created on the firewall?   ... View more

@kiwi Shouldn't a PA5220 be able to handle 1 Gbit/s of traffic - even if you enable ALL available security features? (Assuming that only the speedtest runs at that moment) ... View more

If you use your method: have you set every URL category to block? ... View more

Configure and enable TLS decryption*: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/decryption/configure-ssl-forward-proxy Create a custom URL category with your entries Create a security policy where you add your custom URL category directly into your rule (in the service tab) Do not create any other rule except a deny-all rule for that zone *without TLS decryption you'll be only able to filter for the domainname but not edition.cnn.com/health ... View more

Hi @BatD   Here are some other methods (until someone writes in the community who already solved your problem): Open a TAC case: PAN-OS 7.1 is still supported so in theory PaloAlto should have a solution for customers like you Do you have a spare device where you could do the config migration? (Probably worse than the try&error method from your customers perspective) upgrade one clustermember to get the migrated config, export it and downgrade back to initial version   All in all the try&error methof probably isn't that bad. Of course this needs some time, but as the new hardware should already be there ... and after the first one, you probably know what to check and the remaining ones will be easier... ... View more

Could you post the FR ID here ... I think there are also others who think this is required today (including me).   --> OCSP must-staple ... View more

Are you talking about OCSP Stapling? ... View more

Then you probably have to migrate this config manually and hope for the best 😛   I have done something like that only with panorama so I have no real experience with your situation. Things like the policy and opjects aren't that different in the config-xml, the same with network configuration. In the deviceconfig (and also in the other parts) there are new things to configure but in general it will also work without having them configured. As it will be a try&error process anyway with a migration from 7.1 to 8.1, the easyiest way is to export and import the config and check for errors when you try to commit. ... View more

Are you/your customers may be using panorama? ... View more

The exclude lists only have an effect if you configure also an include list entry. So the exclude entries are only for exclusion of a subset of the subnets specified in the include list. Specifying only exclude entries result in an exclusion of any network. The difference between the user-id agent and zone config is ... User-ID agent configuration applies globally to the user-id configurstion and also for the redestribution feature. https://www.paloaltonetworks.com/documentation/80/pan-os/web-interface-help/user-identification/device-user-identification-user-mapping/include-or-exclude-subnetworks-for-user-mapping Zone User-ID configuration applies only to that zone where you configure include/exclude entries. https://www.paloaltonetworks.com/documentation/80/pan-os/web-interface-help/network/network-zones/building-blocks-of-security-zones#id15b17daf-f222-447c-bfee-a0c4cb8ae9f7 ... View more

@rshetty I think you cannot compare your issues to the once in this topic (2 repectively 4 year old topic). What versions PAN-OS and GlobalProtect are you using? How are the users connected when they complain about reconnects: wired, wireless, mobile? ... View more

@JohnUrbanek The option to override values directly in the template stack is only available since PAN-OS 8.1. But even with this option this does not solve the example mentionned by @mr.linus. it is still not possible to reference opjects in one template which exist in another template. And back to the example with the ldap-adminuser: of course it is possible to create the ldap server and authenication profile in one base profile, but then you would have to configure the adminuser on every templatestack or at least some template stacks depending on your configuration. For other examples 8.1 solves the issue like the one with global protect: configure the server and auth profile in the base profile and then configure global protect in the template stack, like in your example. This way you can reference objects from templates that belong to thw template stack. ... View more