About SShnap

I'm on version 10.1.4H4 and have the same issue with IPv6 showing on all reports how to get rid of this? ... View more

@goepfrichb  I found another way to do it..... under: Device --> Authentication profile --> enter azure profile --> under Authentication tab --> check the option "Enable Single Logout"    this will do the work for logout global protect and azure at the same time ... View more

@domari  In our case we are using DUO so we user SAML and I'm looking for a way to add SSO for guacamole server. on DUO I don't see the option to add bookmark from their side. ... View more

HI @domari  New day new thinking. Found the problem, found wrong configuration on the portal. under global protect portal config --> clientless vpn --> general  I put the guacamole server address in the host name instead of the vpn portal address. now it is working fine. I need to see how to use SSO for the guacamole rdp session instead of entering the credential again after the user pressing the guacamole application.  ... View more

Hi There   I had the same issue with SAML and LDAP group memberships, I'm using DUO with global protect and my intend was to customize the application based on group memberships. I used @JohnWade solution and under authentication profile I changed username attributes from user.username (as DUO instruction) to <domain>\<username> and it is working great. thank you for the help. ... View more

Hi @a.jones    According to what you described local site is 192.168.90.228, remote external IP is 85.90.253.239 and destination IP is 10.0.8.82 and you want to NAT the source.   1) you need to include local IP NAT address in proxy ID of the tunnel.  2) Check "Enable NAT Traversal" on the ike gateway advanced options. https://pa.rei.edu/PAN_help/en/wwhelp/wwhimpl/js/html/wwhelp.htm#href=ike-gateway-advanced-options-tab.html#ID0EPCDT 3) create NAT rule with the ipsec tunnel as the destination interface for translating the source.  4) make sure your security policies include the NAT address if you created specific source IP address.   I use this source for ipsec tunnel using nat configuration. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClopCAC   Good Luck     ... View more

@gwesson   PANOS 9.0 will be great with this and policy optimization.   thank you. ... View more

Hi @danilo.padula   Please check the logs if the traffic is being decrypted, Pay attention, for Facebook site palo alto identify the application as facebook-base that's why it being blocked, for Facebook site you should add facebook-base for allowing it. See my attachment, regular sites that palo alto identifies applicaiton as web-browsing will be match to that policy rule, if the site uses other application you need to allow that specific application.   ... View more

@BPry Thank you for the reply,   So for the users who decrypting the traffic, do we need to create custom application for web-browsing on 443?   Because with the current situation I need to create another policy rule to allow web-browsing on 443.   I think it will be better to create new application like: Secure web-browsing.   ... View more

Hi @gwesson@DaniloBarbosa@kiwi   I think they should release an application list update, which add working port 443 for web-browsing application.   I also notice that once you decrypt traffic on 443-SSL it becomes 443-web-browsing, so policy rule that allow web-browsing on application-default will not work, because the application-default is 80.   You need to create another policy to allow web-browsing application on 443 port.   ... View more

Hi @yhlee1   I have the same issue with old and stable ipsec tunnel between PA3020 (8.1.1) and VM200 (8.0.10).   suddenly the tunnel is not working even when the connection looks fine and system logs show tunnel is up.   on source side I see traffic go to tunnel and aged-out, on destination side logs don't show the traffic.   when I change something on the tunnel config and revert the changes or disable/enable the tunnel it come back to normal. ... View more

@OtakarKlier   SW is receiving the traffic from palo alto but is limited, I can’t drill down in the information.   I see 1-2 levels of information, when I want to get more details on the traffic and endpoints it show me the error. ... View more