About BPry

@mduhon, Just to verify, you are trying 'show' instead of the indicated 'how' correct? The command definitely exists on PAN-OS 10.2 and PAN-OS 11.0 without change.  ... View more

@lprasad, To answer the second part of your question, the machine doesn't need to be joined to your domain to install the agent.  ... View more

@AhamadullahM, This isn't a functionality that's built into the firewall, nor would it be something that would be easily implemented. You could hypothetically script something that tracks users using the firewall's API and past a certain number of associations start clearing the mapping, but there's some disadvantages to that method and quite a few things that would need to heavily rely on how you have things architected on your network.    A better way of attempting to do this would be setting up GlobalProtect and enforcing a connection. This would allow you to actually script a limit of connections any one user can have and disconnect any new connections past what you're limiting it to.  Obviously this would again have to be considered in conjunction with your network requirements and how you actually have things setup. This is also another solution that currently relies on external scripts to accomplish this behavior, as it's not supported by the firewall by default.  ... View more

@AmitKa79, I've found that I get better RDP performance through PAN when you disable the ability to use UDP. Might want to try that on a machine that you're having an issue with and see if that goes away.  ... View more

@cemcga That's not 100% correct since you can still glean some information from encrypted traffic, but it's extremely limited in nature. So as an example, you could still build an app-id off of something like the ssl-req-client-hello even if you aren't decrypting the traffic.  ... View more

@RobertShawver, Depending on how often you find yourself doing this a CLI check (or a script that uses the API) may be a more efficient answer than looking at the GUI and having to check each entry.  request system external-list show type ip find <value> name <ListToCheck> Replace <value> with whatever you're searching for, and the <ListToCheck> with whatever your EDL names happen to be configured as. Ensure that type is set properly for whatever list you want to search through. I just find this solution easier if you're finding yourself having to do this on a frequent basis or need to search through a lot of lists rather than going to each entry and searching in the GUI. ... View more

@SARowe_NZ, Did you ensure that the device certificates were all setup and working properly when you configured the firewalls? That's the one thing within AI Ops onboarding that would cause data ingestion issues if it wasn't working properly as far as I'm aware.  ... View more

@ssabbarapu, License expiration on a physical firewall wouldn't cause the firewall to restart regardless, that isn't how PAN-OS handles license expiration on hardware. I'm assuming that you've actually been running 8.1.23 for a bit without issues since 8.1.24 was released a few months ago correct?   If you have support on the device I'd recommend opening a TAC case to actually look at the logs to try and identify why it's restarting, but it's quite possible with a PA-200 that you're running into some hardware component fault. You can try upgrading the firewall, but I wouldn't personally jump to that when you have a randomly rebooting piece of hardware. The possibility that it reboots during the upgrade process and corrupts itself isn't zero.  ... View more

@inderjit21, Correct, the response page won't be serviced unless you're decrypting the traffic by default. You can override this setting by running the following command without setting up decryption. set deviceconfig setting ssl-decrypt url-proxy yes   Keep in mind that this will only work if you aren't in a vwire deployment, ssl decryption is an absolute requirement for that configuration. Keep in mind that your clients will receive an invalid certificate warning unless you take the time to setup a proper Forward Trust certificate to allow the response page to actually be trusted by the clients.  ... View more

@Alpalo, This wouldn't be an option from the firewall's side of things. You'd need to resolve whatever issue is preventing the clients from updating the PTR record.  ... View more

@grenzi, If you have an account team, I would pass this on to them and have them push it through internal channels. I don't know how well pushing something like this through TAC would actually work.  ... View more