About BPry

BPry · ‎04-10-2023

@Fipaterm, Are you attempting to plug the laptop directly into the PAN device? Assuming that you are, you likely don't have the laptop configured for VLAN tagging and therefore what you have configured isn't going to work. You'll need to configure the device to tag traffic properly, or utilize a switch with a proper trunk configuration and break out the access ports as required on the switch.

BPry · ‎04-10-2023

@osaman, Apple requires that certificates not exceed a validity of 397 days to be considered valid certificates. That's always the first place I'd look if you have reports of issues with certificates on an Apple device. Also to be clear, when you say "one of" do you mean that only a single user is having this issue, or is all of your users running macOS encounter this issue?

BPry · ‎04-10-2023

@MatthewUber, Short of having them setup a dynamic dns service and allowing that FQDN object through a separate security rulebase entry, you'll need to at least allow the region access to the portal and gateway address. When it comes to the GlobalProtect client configuration, you can create a separate config for just this user in particular that allows the source region as connection criteria.

BPry · ‎04-09-2023

@rbates, In this particular example, the selected connection method should never have a disconnect button present. While disconnect would be present on a connection where the connection method is set to on-demand, it wouldn’t be present on an always-on connection method and it shouldn’t ever be present. These connection methods may give you an option to disable the agent if the capability is allowed, but it wouldn’t present an option to disconnect like an on-demand connection.

BPry · ‎04-07-2023

@ETorres4, This really depends on how many requests are in the queue at any given time. I've seen it come back in a couple days to it taking over two weeks for approval.

BPry · ‎04-07-2023

@Resquivel, You can do this through support.paloaltonetworks.com under the 'Assets' tab assuming that you have access to the account and the device is associated with your account. If it isn't, you'll want to open a TAC 'Admin' case and they'll be able to address this for you.

BPry · ‎04-07-2023

@osaman, If you have your app config set to allow users to upgrade the app that is expected behavior. GlobalProtect doesn't disallow installation of the 6.0 or 6.1 clients on a Windows 8.1 client, so the upgrade will be allowed to install. On these older clients it may break things. Assuming that you want your supported clients to still get upgrades directly from your portal like most customers have things configured, you'll need to create a separate agent configuration that targets these outdated machines and set the app config to disallow upgrades. The most direct way of accomplishing this is simply targeting the user or device as it's the easiest way to set this up. However, through 'Custom Checks' on the config selection criteria as long as you have a GlobalProtect subscription you can make this more dynamic. You'd want to add a custom registry check(s) via HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion and find a corresponding value. If I recall correctly, prior to Windows 10 you should be able to read 'CurrentVersion' and it should read 6.3 for Windows 8.1 and 6.2 for Windows 8.

BPry · ‎04-06-2023

@securehops, I don't have any acknowledgement that it was addressed officially by PAN outside of an update I have on a TAC ticket earlier this morning. A lot of the false positives that I gave as examples were addressed earlier this morning, but not everything. It looks like they attempted to clear things up but more minor domains may need to be individually reported.

BPry · ‎04-06-2023

@securehops, This is said to be addressed, however someone of the domains falsely categorized last night are still being corrected and reported. If you haven't done so already and you're affected by this, ensure that you've cleared the cache on your firewall to verify that you have the current categorizations. I've listed the command below. I've sent three updates with a handful of domains still as of this morning that needed to be corrected, but the majority appear to be categorized properly now. clear url-cache all

BPry · ‎04-06-2023

@nevolex, Is this an existing configuration that was working previously prior to the installation of 10.2.4, or is this something new that you are trying to configure? Do you get other messages via this email server profile properly if you have it setup to send any sort of system alerts? Couple things I would try off hand if this is a new setup and not one that broke during the upgrade to 10.2.4: Using the same email server profile setup a log setting entry temporarily just to validate that the firewall can actually send messages to that server properly if this is the only time you're attempting to send email with this server profile. That'll tell you if it's solely related to emailing reports or if this is a broader issue. Attach the generated report and just email that using the same account process that you have the firewall configured to use. This will allow you to see if the email is potentially just being rejected by Zoho.

BPry · ‎04-06-2023

@plancerotto, What error are you receiving when you attempt to connect? What errors if any are recorded in your pangps.log file?

BPry · ‎04-06-2023

@JiaXiang, ( stage eq agent-msg) and not ( opaque contains 'Message: nsupdate') The above filter applied to your GlobalProtect logs will provide you with these.

BPry · ‎04-06-2023

@JoeHead, What version of the agent are you pushing out and how are you updating the portal address?

BPry · ‎04-06-2023

@Branko Assuming that you really just need to input the portal address so that the user doesn't need to type it after the install has finished, you can use the following: msiexec.exe /i GlobalProtect.msi /quiet PORTAL=”portal.acme.com”

BPry · ‎04-06-2023

@osaman, GlobalProtect doesn't officially support Windows 8 anymore. While that doesn't mean that it won't work, it does mean that its not validated against and as far as the agent working you're kind of running on borrowed time. Assuming that you can update these machines to Windows 8.1 (or you are talking about Windows 8.1) then support stopped in 5.2. Windows 8.1 isn't support on 6.0 and you should keep these clients on 5.2.

Member Since	‎05-26-2016 07:16 AM
Date Last Visited	‎02-24-2026 02:19 PM
Posts	6,520
Total Likes Received	2296

Online Status	Offline
Date Last Visited	‎02-24-2026 02:19 PM

Unlock your full community experience!

About BPry