About ACieszkowski

Our you could just export whole configuration to XML file and search it. Considering log size - look at what you are logging. Some chatty protocols (example: DNS) are not always worth logging, think about updates (adobe-update, ms-update) and so on. Look into ACC, sorting by sessions, at applications. Search for those that you are willing to "sacrifice", disable logging for them. ... View more

Interesting use case. I have not tried nor thought about it but I do not see why it would not work. Rather easy to test, too. Please share you experience 🙂 ... View more

Refer to: https://live.paloaltonetworks.com/docs/DOC-3552 If it is possible paste lines between <globalprotect>...</globalprotect> ... View more

Management interface improvements - look into features of FMT 2.0! ... View more

Can you paste your GlobalProtect configuration in XML format? ... View more

Hello, Try creating separate LDAP Server (port 389 or 636) profiles for the parent domain and each child domain including in the configuration NetBios-style domain name and corresponding base. In Group Mapping Settings create Group Mapping configuration using every LDAP Server Profile (8 in total). Hope this helps! Update if it does 😉 Global Catalog is used for identifying membership in Universal Groups. ... View more

If the monitored IP is unreachable this PBF rule is disabled, PBF policy is further evaluated for another matching rule and then the routing table - traffic is send according to what is matched. When the monitored IP is reachable again the PBF rule will be enabled. I see you are configuring tunnel.1 as the egress interface - why not use the IPSec Tunnel monitoring? ... View more

I understand that you want to map different drives to different groups, yes? What method do you use to mount drives - logon scripts or Group Policy? Have you tried both? Have you enabled Single Sign On in GlobalProtect configuration? Can you post your GlobalProtect configuration (xml format)? Personally I have not implemented pre-logon anywhere yet, but I will. ... View more

daniel.li@tcdsb.org - I believe my first post on this issue clarified it. You can always change the user for "pre-logon". ... View more

I believe not, but try doing SNMP Walk on your box and look for OID I mentioned. ... View more

daniel.li@tcdsb.org - now I am utterly confused. First you wrote: We had an issue that logon script is not working if we put group either  domain\user group or LADP format  cn=network_tech,ou=groups,dc=domain,dc=com but if we put any in source user in security rule and authentication profile it will work Then: If both place are Any. logon script will NOT work in our case I do not know what works for you, and what does not. ... View more

daniel.li@tcdsb.org - What about the third place in which you can add user/group, GlobalProtect Portal Client Configuration? Does pre-logon is successfully establishing connection, apart from running scripts? ... View more

daniel.li@tcdsb.org - if I understand you correctly Windows' logon scripts are not working when you put specific user or group in security rule? Please refer to: https://live.paloaltonetworks.com/docs/DOC-2020 for comprehensive information about configuring GlobalProtect. Reason why scripts are not working with specific user/group in security rule is: All pre-logon VPN connection will report a generic “pre-logon user” to User-ID. Username is not known at the time the connection is established. Username is reported to gateway once the user logs in to machine. Taken from GlobalProtect Configuration Tech Note. ... View more

You would need OIDs from 1.3.6.1.2.1.4.20 (ipAddrTable, look it up on: http://www.oidview.com/mibs/0/RFC1213-MIB.html) - but as mentioned here: https://live.paloaltonetworks.com/message/9788#9788 PAN implementation of RFC 1213 is not complete. Older SNMP Walks does not show any information about IP address of particular interface (it could have changed, though). ... View more

You could try: show jobs all on the output identify ID of the download process and then: clear job id <ID> ... View more