About Claw4609

Hello,   I would generally match the authentication between the gateway and the portal. If you dont want users to have to enter their credentials on both the gateway and the portal, you could do something like just requiring certificates for the gateway authentication otherwise you should look at GlobalProtect Cookie Authentication Cookie Authentication on the Portal or Gateway (paloaltonetworks.com) ... View more

Hello,   If your firewall are connected to your AI-Ops instance you can go to dashboards and select the best practices tab. If your firewalls arent connected to your AI-Ops instance you can select the On-demand BPA tab and upload a TSF there. You may have to add these tabs under the More Dashboards tab on the top right.      ... View more

Hello,   Are you using physical PA appliances as your GlobalProtect gateways or are you using Prisma Access? If you are using Prisma Access that status can be monitored here: Prisma Access Status (paloaltonetworks.com) ... View more

Hello,   It doesnt appear to be hitting your NAT rule, if it was the destination zone in the traffic logs would be "inside". Two things I would check would be verifying that the "ITSNetwork1" is in fact a part of that "ITSNetworks" address group. The other thing I would check would be the service object itself, and verify that either UDP or TCP is selected depending on what you are needing. And that the port information is filled out in the destination port sections, and that the source port (assuming you dont need to specify a source port) is left blank.    ... View more

Hello,   I got a similar error when updating from 11.1.2 to 11.1.4. You should probably open up a TAC case as in our instance TAC needed to log into root of the device which you won't be able to do on your own. ... View more

Hello,   I would recommend continuing to work through your IT department as without access to the gateways and logs, troubleshooting may be a little difficult. My thought with it initially connecting and then giving up could be that ICMP is dropping somewhere and the heartbeat/liveness check is failing. ... View more

Im actually able to replicate this as well, still currently looking into it in my environment. However, the issue appears to be that its trying to switch between IPv4 and IPv6. Running a packet capture on my machine and pinging 8.8.8.8 I can see that traffic consistently, but then when I switch to a different wifi as you stated I then start consistently doing IPv6. I disabled IPv6 on my wireless network adapter and things started working immediately. I can replicate the issue on 6.2.3 as well but not 6.2.2. ... View more

Hello,   Here is the PAN-OS release guidance article where they mark preferred releases: Support PAN-OS Software Release Guidance | Palo Alto Networks ... View more

Hello,   "In this step what will be the intermediate chain and the root chain of this new certificate? The same as the server on the internet?"   - The client would be presented with a cert that is signed by your Forward Trust Certificate that you have selected in your firewall. So if you went to google.com it would be a google.com cert signed by your Forward Trust Certificate.    "Which key will be used by the client to encrypt traffic between it and the firewall?" - Your Forward Trust Certificate. The firewall wouldn't have access to the private key of a server on the internet (assuming you don't control this server)  ... View more

Hello,   If you look at the traffic logs do you see the MGMT interface communicating with WAN traffic fine? Is it getting bytes received on various traffic? I forget the exact app-id but I believe its "paloalto-updates" do you see that application in the traffic logs?    Would also just select "check now" again on the download page again and then try again. Also verify you have an active threat license on the firewall.  ... View more

Which version are you using? Its looks like that setting was renamed to "Advanced Control for Tunnel Mode Behavior" ... View more

Hello,   Are you managing prisma via Panorama? You can disable IPSec under the GP Gateway. What are you looking to disable IPsec for as IPsec is more secure and more efficient than SSL.   ... View more

Hello,   Are you looking to not push out the GlobalProtect update to Linux users? If so, you could create separate GlobalProtect portal app configurations, with one being specified to Linux OS, and then disable updates.   ... View more