About BPry

This question really depends on if you are running Skype for Business on premise, or running it through Microsofts online application. They both require different ports, but I don't believe Skype for Business online uses port 5061 so you are probably using an on-premise server, but you should verify with whoever is running your Skype integration.  IF this is Skype for Business on premise then the ports that they are using are listed HERE. Be aware that just because Skype for Business on prem is setup to use a specific port by default, your system admin could have set it up to use any port that they please. Therefore, I would double check that the ports listed were the ports used at the time of install. *Port 5061 specifically is used on front-end servers for internal SIP traffic, and SIP communication from the Front End servers to the Mediation and Monitoring servers.   THIS  link will guide you through everything that Microsoft states needs to be open for Skype for Business if it's being ran through their online service, note that port 5061 is not mentioned here.  ... View more

Did this just start to happen or is a an ongoing issue? It sounds kind of like an issue you might run into if you have service routes configured but removed the IP address from the Management interface; but I would assume that you would have more issues then just HA not being in sync. It could also have something to do with a static route being added that would include your HA IP addresses, but not actually routing the traffic through the correct interface. ... View more

I'm sure the answer is yes but just to be sure, there is the allow list on the Authentification Profile and the actual GlobalProtect Portals, is the user group allowed on both of these? *As a side note their is a known issue on older versions of the software where authentification issues would take place if the firewall was running for more than a 1 year time period without being shutdown. I would start with seeing if that fixes your issues if you are in an enviroment where you can schedule a restart in a resonable amount of time.   ... View more

I don't believe the process of how they access the application would matter much if you are blocking the app-id for Youtube. Like others have staded you could whitelist the specific URLs or you could try and see if there is the possibility of creating a custom signature that would be allowed but only having access to the one 'channel' that I'm sure all of these videos are under; I've never created such a signature so I don't know if there would be anything identifiable that you could build the packet on.  You might be able to allow users access to the specific URL of the training course 'channel' (youtube.com/channel/training) or whatever it is and see if that works. My guess would be no, but it never hurts to try.  ... View more

We had this issue a while back without being up for a year or more; turned out that we simply needed to remove the authentification profile (not the LDAP server settings) and then everything starting flowing correctly. That being said I do believe that the process hung and clearing out the profile had the service restart. If your enviroment allows it I would just schedule a restart over this weekend and see if that fixes it, if not then try the above suggustion and see if it works for you to.  ... View more

Just because the same information/configuration is present on identical software doesn't mean that their can't be something wrong with the underlying OS of the firewall. You could have a process that isn't behaving correctly or a kernal that didn't take a software update as expected that could be causing the issue. It's the same on a computer, just because they do the same thing and are the same model doesn't mean that they can't have issues that the other isn't experiancing.  ... View more

I won't deny that the entry is confusing, however  Each EBL is counted as one address object and does not contribute towards the platform maximum for max-address, i.e. if the device maximum address is 5000, you can have 10 EBLs of size 4700 each and 4990 other address-objects.  That entry is where they talk about the address object limitations; the example that they gave with the limitation of 5000 entries is from a PA-3020.    I wouldn't say that the document is very well put together, and PA should update it accordingly, however it isn't to the point where you can't decifier what they were trying to relay. I will say that describing how PA does EBL does require a knowledge of the address object limitations on any particular device; as without that knowledge you could imagine that 4700 entries on an EBL would count as 4700 address objects, which would put PA-200s and PA-500s over the maximum amount of address objects they can process.  ... View more

I might suggust going to 7.0.6 or 7.0.8 and moving away from 5.* or 6.*. I can confirm that on our 3020's both versions are running without issues and I can't think of anything off-hand that was removed since 5.*.  ... View more

I don't believe that this is implemented at all. I currently just use the dump into an excel file to look at security rules and manually look at the other information as required.  ... View more

YOu are confusing what the two graphs are actually saying. A PA firewall regardless of version can have 10 external block lists that compose no more than 50000 IPs in total. The graph at the very bottom states how many anddress groups can be on any one device. The EBL that you configure counts as one of these address groups, regardless of how many entries it actually has.  ... View more

I'm a little lost on what you mean by "multiple outgoing connections"? Do they want you to NAT more ports to the internal servers Public IP address, or do they simply mean to say that the Public IP address is only allowing one connection from your company at a time? ... View more

Okay, then you would need to take them out of your authentification profile under the object tab. Under your LDAP/Radius/Whatever server there is an allow list under the advanced options. It might be worth making a VPN-Allow AD group and putting anyone who needs VPN access under that group, this would keep anybody that is not in that specific AD group access to the VPN gateway. To my understanding their is no way to do a 'not' statement under this option.  ... View more