About BPry

@KarlHalpin, I personally recommend that clients keep a script running that can record the number of active users. The basis of that is simply ' https://<firewall>/api/?type=op&cmd=<show><global-protect-gateway><statistics></statistics></global-protect-gateway></show>&key=<key>' and you would want to parse the return to ['response']['result']['TotalCurrentUsers'] to return the value of active users. This value can then be written in any format that you want whether that be to a log file of some sort, a database, or whatever else you decide.    If you're looking solely at historical logs instead of those moving forward, the logout events will give you the duration in seconds that you can use to calculate who was connected when. Obviously this method would present a large amount of overhead and review to get it broken down to a specific day or further than that, but it is certainly possible with enough time investment.    Just realized how poorly that example presented. https://<firewall>/api/?type=op&cmd=<show><global-protect-gateway><statistics></statistics></global-protect-gateway></show>&key=<key> # Replace <firewall> with your own firewall FQDN/IP # # Replace <key> with your API key # ... View more

@HilineISP_Tech, I'd recommend scheduling an upgrade to 10.1.9 (the current preferred release) since support is likely going to recommend you do that anyways. There's quite a few GlobalProtect related issues that were addressed since 10.1.2, and while I can't point towards one specific example that caters to the issue you're seeing, I can tell you that you're missing fixes for multiple CVEs. The following list should get your update approved, but if you need more look up the security advisories because that's not all of them.    CVE-2022-0028 CVE-2022-0024 CVE-2022-0023 CVE-2022-0778 ... View more

I'm assuming that @qmso475 and @HilineISP_Tech are the same people? When you potentially mix accounts the replies become extremely confusing to follow. I can assure you that 6.0.6 functions perfectly fine on supported versions of PAN-OS on an iOS device running 16.4. I currently have a couple hundred connected without issue.   What version of PAN-OS are you running on the portal and gateway that you're connecting to?  ... View more

@MamadouCisse, https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-web-interface-help/network/network-interfaces/layer-3-subinterface   Give that link a good reading and then go through and look at the DHCP configuration docs as well. What you're asking is a straightforward process, but in this instance I'd actually suggest that you find someone (either internally or through a partner or whatever) that can help guide you through this process. Being a remote office and not knowing anything about your management access, there's ways you could do this that would require someone physically on-site to fix if you screw something up. I'd recommending using a more knowledgeable helping hand for this task as you get more hands on experience with configuring PAN-OS. Find someone that won't just do the work for you, but actually walk through the why and how while you're the one actually doing the work. There's a number of considerations to make in regard to the rest of the configuration that will need to be updated to really see a lot of benefit from this change. You'll want someone knowledgeable about the platform to actually review your configuration as a whole.  ... View more

@qmso475, What's your actual goal here? The App Store is the only location where the iOS application itself is actually published. Not sure why you don't want to use the version that's readily available.  ... View more

@HilineISP_Tech, What version of PAN-OS are you running on the portal and gateway? What does the associated GlobalProtect log events say when you check them on the firewall or prisma access? Are you using the IP address directly or the FQDN?  ... View more

@samulelebarbera, Unless something has changed recently this isn't possible on the endpoint. If you're running into memory utilization issues you'd want to open up a ticket with TAC and have them investigate why you're seeing an increase.  ... View more

@GajananDixit, If you're going to use a media converter the only thing I would really caution is using cheap devices for these links. I'd recommend spending the money for a managed unit so that you can monitor for faults outside of the interface just failing.  ... View more

@Rajendra-S, You've configured a MineMeld server with over a Terabyte of memory? That's vastly over provisioned and I'd highly recommend you lower it. Even 10GB seems excessive for a MineMeld instance; all of my nodes run with 2GBs of memory and I don't encounter any issues at all.  ... View more

@DuggiFresh, Gonna go out on a limb and say that this is the first app-id based rule that you have in your rulebase? If that's the case, that'll match a whole lot of traffic as the firewall needs to allow enough traffic to identify the application. As soon as the application is identified, the firewall will reanlyze the rulebase and pass the traffic to the corresponding entry.   As long as this is the first app-id based rule that is in your rulebase, or is the first for at least a subset of your users, this is expected behavior.  ... View more

@samulelebarbera, I'd generate a support file and take a look if you're seeing an increase in memory usage. Outside of someone making a file scanning change you shouldn't be seeing any sort of resource increase reported with the latest agent.  ... View more

This is still not available through GlobalProtect; whatever solution you are trying to use GlobalProtect and IKEv2 with would need to utilize a traditional tunnel configuration where IKEv2 is supported.  ... View more

@samulelebarbera, Do you have an established installation in your environment, or is this something that you are just starting to roll out? Generally when this gets reported the root of the issue is that someone is running Cortex alongside another AV product, do you have any other solutions installed alongside Cortex?  ... View more