About BPry

@BigPalo, Couple questions: Do you have a GlobalProtect license so that you can actually utilize this functionality? Have you verified for sure that the traffic isn't attempting to utilize QUIC? This functionality only works with TCP traffic and if your browser is using QUIC (which is UDP) it won't function properly. What agent version are you using. As far as troubleshooting goes you'll want to set your client logging to debug and look in the logs for the domain in question and look for an entry in PanGPS.log that looks like what is denoted below: (P6668-T26348)Dump (2039): 07/04/25 03:02:58:982 Domain name wxt-general-ingressgateway.acmhwxt-prd-1.prod.infra.webex.com matches exclude wildcard domain This will tell you whether it's matching your rules or not.  ... View more

@GregorJus, This is normal to see in the logs and usually associated with gatewa-hip-check events like what you're seeing. I always see it on gateway-hip-check events and it's always between a gateway-logout event and a portal-auth/portal-gen-cookie event.   If I would have to guess what is going on, I think the user is likely suspending the machine and upon it resuming the agent sends spurious HIP check reports; since the HIP reports utilize a cookie with the gateway and the gateway session has already been cleared, the cookie is invalid and the reports aren't processed. I've seen this on BYOD endpoints that aren't forced onto the VPN at random times well prior to them connecting to the VPN tens of minutes later, so that leads credence to it being an issue with the agent when exiting sleep. This is just a hypothesis, but it's the best I can offer.  ... View more

@MikeSangray2019, You can't do this in a single syslog server profile, but that doesn't really matter. I would create one "Syslog-Default" and "Syslog-Custom" and then perform any modifications that you need to on the profile. PAN-OS will allow you to have two profiles with the same syslog server address/fqdn specified, so you can do this on a single server. You would then modify your log-settings or log-forwarding profiles as needed and simply include both syslog profiles that you have created. This will allow you to see how both would come across and customize as needed.  ... View more

@B.Vance, I'd recommend that you look into Cloud Identity Engine since Directory Sync and Cloud Authentication Service will accomplish all aspects of your request.  ... View more

@D.Verma502651, This is doing a lot of parsing of the configuration directly and isn't a feature or function that you can interact with via the API. You would need to essentially replicate the functionality (probably in a more targeted manner to make it easier) and find any matches. I've included a very basic example below given your desire to look at security rulebase entries:   ExampleDescription = 'This is a test description' GetSecRulebase = requests.get("https://myFirewallUrl/api/?type=config&action=get&xpath=/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules",headers=headers) SecRulebase = xmltodict.parse(GetSecRulebase.content) SecEntries = SecRulebase['response']['result']['rules']['entry'] for SecEntry in SecEntries: entryName = SecEntry['@name'] entryDescription = SecEntry['description'] if entryDescription == str(ExampleDescription): print("Entry '" + str(entryName) + "' matches the ExampleDescription") You could then obviously take this minimal example and update it to account for whatever you are actually attempting to do.  ... View more