About Arnesh

Hi @Evan-Amerio    Are you referring to the destination address field and not URL category? If you are trying to allow just the IP addresses, you can add the IPs to the destination address column similar to what is see in the screenshot instead of the URL Category. URL category is manly used for the predefined URLs categories, custom URL categories, to match the website URL trying to be accessed.   If you have multiple IPs, you can leverage the EDL feature on PaloAlto as well. Refer below links to understand EDL. How to configure EDL (External Dynamic List) URL Filtering - Dynamic Block List - External Block List EDL   Regards, ... View more

Hi @suba_muthuram  Yes, the certificate should be installed. However, it depends on how to want to deploy the certificates. Below is the snippet from the GlobalProtect Admin-Guide: For an agent configuration profile that specifies client certificates, each user receives a client certificate. The mechanism for providing the certificates determines whether a certificate is unique to each user or the same for all users under that agent configuration: • To deploy client certificates that are unique to each user and endpoint, use SCEP. When a user first logs in, the portal requests a certificate from the enterprise’s PKI. The portal obtains a unique certificate and deploys it to the endpoint. • To deploy the same client certificate to all users that receive an agent configuration, deploy a certificate that is Local to the firewall.   ... View more

Hi Sanjay,   Please note that the above information can be helpful if looking through the tech-support file. For looking through CLI, you can run the below commands:   MP-monitor logs: tail follow yes mp-log mp-monitor.log less mp-log mp-monitor.log   DP-monitor logs: tail follow yes dp[0,1,2]*-log dp-monitor.log less dp[0,1,2]*-log dp-monitor.log *Select the appropriate dp while running the command   Regards,   ... View more

Hi Sanjay,   Mp-monitor logs are found mp-logs directory (/var/log/pan) for all firewalls device models. Dp-monitor logs are found under directory (/var/log/pan) for smaller platforms such as VM-devices, PA-2xx, PA-5xx, PA-8xx and under /opt/dp* directory for bigger platforms like PA-32xx, PA-5xxx, PA52xx and PA-7k .   Regards, ... View more

Hi @ErrylTobes    Whenever a commit is performed on the firewall, management server is responsible to push the changes to all the respective process. Sometimes this can fail as we see in your case.  This could be because of the cord process not responding or stopped. The best way is to check the status of the processes on the firewall by CLI command "show system software status" which provides the current status. If the process is stopped, you can restart the process (as you did which resolved the issue) and you can also check the logs (In the mp-log > cord.log), if required.   A similar incident is discussed here.   Regards, ... View more