About Brandon_Wertz

@ChrisWimpy wrote: Other users (on the same version) aren't having this particular issue, just me. I'm not sure what would be sending a disable signal to the PANG adapter. I've uninstalled/reinstalled multiple times without luck. Thanks though. You have installed 6.0.10 or just installed the same 6.0.8 software? ... View more

I've not seen this, but 6.0.10 fixes a lot of issues in 6.0, maybe try running 6.0.10 and see if things are more stable? ... View more

@Davidboyes wrote: According to the notes on globalprotect 6.3, CIE should now be compatible with the embedded browser, but I cannot get it to work. I see the requirements for the feature is PANOS 11.2 or later - we use Prisma, so not sure if Prisma is not compatible with it?    Has anyone had any luck with Globalprotect + CIE + Embedded browser + Prisma? This is a feature I'd love to enable for my people, so there is one less browser popup they need to close when it auths with default browser. I've not really looked into this, but I believe this already works...not sure why GP version 6.3 is needed.   I've got this setup: Prisma Access (Panorama Managed) --> Prisma tied to CIE -->  CIE pointed to Azure AD for auth --> GP clients software version 6.0.10 --> Users authentication via SAML auth (TLS1.3) to Azure AD via the CIE/Prisma Integration with embedded browser.  This works seamlessly with no additional browsers popups.  (Our Prisma dataplane is running 10.2.4, with the Prisma Access version at 4.0)   Is this not the type setup you're looking for?  I described TLS1.3 problems in earlier GP client versions in this thread:  https://live.paloaltonetworks.com/t5/general-topics/global-protect-application-blank-screen/td-p/561921 To your specific question though, if you're running Prisma is your dataplane already running 11.2?  Just because you are on Prisma doesn't mean your dataplane is the correct version. ... View more

@RH747 wrote: Hello, On my PA-820 I started getting the idle timeout message below: "Your login session has expired and you have been logged out for security reasons. Please log in again if you wish to continue." Normally this was never an issue and I simply logged back in after being idle. Starting about 2 weeks ago I cannot log back into the WEBUI under normal circumstances. I get caught in a session expired loop. This has been replicated on my device with 2 separate accounts, but my co-worker does not have this issue leading me to believe the problem is isolated to my device.   I can access the WEBUI on Incognito mode and via CLI.   Note: We are required to use MS Edge by corporate policy. Using another browser would certainly work, but not in my context.   Relevant KB's I've found: "Session timed out" when logging on using Web GUI (paloaltonetworks.com) WEBUI session logs out with message: You have been logged out d... - Knowledge Base - Palo Alto Networks   Troubleshooting steps (tried logging in after each listed step): I tried the typical clear cache/cookies for Microsoft Edge Repaired MS Edge Reinstalled MS Edge Deleted all admin sessions via CLI with >delete admin-sessions This resulted in a successful login then reverted back to the same error. Adjusted the idle timeout to indefinite to see if that would allow me to login since it can never expire (it did not) Rebooted MGMT Plane via CLI with >debug software restart process management-server Rebooted entire NGFW This resulted in a successful login then reverted back to the same error. This isn't a huge issue as I can simply access everything though CLI or incognito... but it's incredibly annoying and I'd like to try and fix it! Has anyone experienced this problem and what was a permanent solution?   Thanks! When you get automatically logged out there's a button for "login again" (I think.) If you click that button are you able to successfully login?   I've experienced what you're describing on 10.1 and 10.2 PAN-OS release, but I use Chrome not Edge as my browser.  When I see this notification I usually just reload the page and I'm able to login w/o issue. ... View more

@Tom_Buscemi wrote: Hello Remo,   Are you willing to share your configuration with us?   Regards, Tom You're probably better off starting your own thread with a specific issue or question you might have.  This thread being almost 7 years old there is a tremendous difference in functionality between the GP client and the Windows OS.  Especially with Windows Hello For Business now existing and functioning differently than the legacy Windows Hello. ... View more

@jbusby wrote: Hi , I've seen a similar issue , it related to some Internet Explorer Group Policy setting applying to the affected machine .  Are you a windows user, do you perhaps as an admin have a different IE config to your users?  I think this was the relevant post for me - https://www.reddit.com/r/paloaltonetworks/comments/qqbrcp/win10_msft_sec_baseline_conflict_w_gp_embedded/ I think your comment months ago was probably spot on.  Sad part is with this reddit thread being as old as it was, Palo was doing nothing to fix the calling of WebView2.  It wasn't until our issue and forcing this with Palo, that they got their development team involved in recoding the GP client to call Webview2.  It wasn't something that was even on their radar, to my knowledge, of integrating into their software. ... View more

@cosmith8000 wrote: Did you ever get a fix to this issue? I have a user getting this exact behavior, if I use my username it works fine. If I use his username I get a screen just like yours. That means this cannot be a pc issue. as both are on the same windows session.   Thanks    I'm not 100% sure this is the exact cause of your issue and the OP's, @SamiPTfA , but we had an issue using SAML auth and using the "embedded browser" for authentication.  GP client versions before 6.0.10, 6.1.5 and 6.2.3 do not support TLS1.3 for authentication, as the software called the Windows OS component called "Webview."  Webview calls the legacy Internet Explorer browser.  Since IE doesn't support TLS1.3 the GP client calling this component the SAML auth intermittently fails.  So the GP client cannnot broker the TLS1.3 SAML authentication to the external provider.    We had users that intermittently receive a similar GP client pop-up.  With the GP software release of 6.0.10+, 6.1.5+ and 6.2.3+ the software support "Webview2" which uses the "Edge" version of the Windows OS browser.  Because the GP client is calling edge, via Webview2, TLS1.3 is supported.     Once we migrated clients to GP version 6.0.10 users no longer failed to authenticate or receive the GP window popup.     --edit--  If using the "default browser" for authentication the SAML auth request is handed off to whatever the Windows OS default browser is.  In this case Edge or Chrome installed in a Windows 10/11 machine of course support TLS1.3 and clients never get stuck in this auth failure.   This could also be masked by the local machine having TLS1.3 disabled in the advanced settings of Internet properties.  With TLS1.3 disabled on the local machine earlier GP client software versions can't call TLS1.3 and therefore the use of the legacy Webview works with "embedded browser" selected as your authentication method.   The setting is in the Portal app config.  With "no" it's using the embedded browser within the GP client.  If yes, the SAML auth is offloaded to the Windows OS   ... View more

@SaiTeja_1 wrote: We have an overly permissive rule with Source, destination and ports as Any. We are working to remove this rule but this  is widely used. Please suggest what's the best way to identify the traffic using this rule and to create rules with specific source, destination and ports. The native UI won't give you exactly what you're looking for.  Native in the UI you can go to the rule, then the "Usage" tab then click on the "Compare Applications & Applications Seen   From here you can see the apps that have been seen/allowed on this rule.  You can then chose to add them to the rule.     If you're wanting to easily identify and allow/block source IP, destination IPs or destination ports/applications the native UI (GUI) doesn't have that feature.  To do that you will need to stand up a separate Palo Alto tool called expedition.  Expedition is kind of like a Panorama, it has a similar Palo Alto GUI, but can do what you're looking for.   Or you can purchase an entirely different tool such as FireMon or Tufin.  Both of these products are designed to do what you're looking to do. ... View more

@BRI-IT wrote: Hi All,   We are in a scenario where we are running firewalls on trial licenses.    We have purchased the licenses. Can you help me with following queries : 1. When firewall transition from trial -> purchased license, will firewall drop the network traffic ? 2. Any recommendation on scheduling downtime for it ?  I'm not sure about SD-WAN, but other licensed features moving to a newer permanent license shouldn't cause any performance impacts to any traffic traversing the firewall.  A downtime shouldn't be needed, that said take whatever change procedures your organization adheres to. ... View more

@FabioHufschmid wrote: We also have this problem. How can i disable on PANOS 10.2.x? If inbound traffic, a.e to a reverse proxy is decrytped and certain urls allowed for a handfull src ips but for all other not, the firewall display a application block page. For internal to internet this is ok, but not for the other way. Also chancing the policy action to drop or reset client does not work. We also have the interface mngt profile on the internet interface, without response pages, but they are displayed. Seams to be a bug. Unfortunately it isn't a bug, and counter to my understanding and belief years ago (in 2019) in my post this isn't something that can be turned off.   Using application level blocking (APP-ID) is a global thing and actually has ZERO to do with a management profile and enabling response pages.  If enabling response pages on APP-ID there is no way to not present a response page to an untrusted zone.       The interface management profiles, enabling or disabling response pages there is a HTML level thing and isn't associated with the APP-ID response page function.   This is what I was told from my Focus Services account team and DE.     So in short it's either on or off globally as far as APP-ID response pages are concerned.  Anything else is a Feature Request / enhancement to the product. ... View more

@aalfaro wrote: Cordial greetings Thank you very much for your answer, I think I understood you, however, I ask you, you mention that the devices can have the same policy settings or Devices-Group as they are different models, but the template would have to be different. The question is, if I want the new device to have exactly the same configuration of the Network and Device tab (taking into account that it is a replacement), what should I do? They follow exactly the same ips, interfaces, vlans etc) How would I do to load the same template config to the new device? What would be the step by step 1. Do I have to duplicate the template that is productive and when I connect the new device I assign it to it? 2. Do I register the new device and have to do all the network and device configurations from scratch? Can't I migrate the existing config to the new FW? 3. What would be the best option considering it is a hardware upgrade, but the configurations are the same? 4. How would you do if you are asked to upgrade the FW of a site, but you have to respect the same configuration, considering that the device is managed by panorama? The information really is there, you just have to play around with it.  A lot of times you can "clone" objects and modify them for a different use case.  In this case it's tied to (or can be tied to) templates and template stacks.   Take your existing config, clone it then add the 440 hardware to the new template stack designed for the specific hardware type.  You don't necessarily need a unique template for the different hardware, but the port count or type will be vastly different from a 220/440 versus a 5200 for instance.  So that's what having the same like hardware in a template/stack is the better approach.     ... View more

@aalfaro wrote: cordial greetings The question is, how do you download the config from the 220 and import it to the 440, bearing in mind that the 220 is managed by panorama. That is, I tried to do what you mention to load the config, but it happens that if I do it from the 220 the xml file, brings me only a few lines of configuration (mgmt interface information) does not bring all the configuration, because its administration is given from Panorama. Now, I tried to download a file from panorama selecting only and exclusively the DG and the template, as shown in the attached image, but when I read the xml file in a notepad, I see that there are all the configurations, including those of the other templates and DGs of the other teams, I do not know if I need something when I download it just to have the configuration of the team. Regarding the error, unfortunately I did not take a screenshot of the errors. Being honest, to migrate that config and the only way I found, was to do it by load config partial, loading all the panorama config file to the FW; however, I raised the question in the forum, because I think there must be a much more practical and simple way, I do not think I should resort to this Tell me or explain me exactly how you would do it. I remain attentive If the device/config is controlled from Panorama then there's no need to export any configuration from the existing device (PA-220) then trying to load that config into a PA440.     Using device groups, templates and template stacks you can have multiple hardware types loaded with the same security policy.  There will be/should be unique hardware config based on the device template.   As an example we have 3220 and 3400 hardware types that receive the same security policy configuration.  This is achieved by using a specific device template for the corresponding hardware type and associating the hardware platforms to the same "Device Group."   Exporting a config and trying to import one won't create the "managed" relationship of the new PA-440 by panorama.       ... View more

@IT-Esp wrote: Hi, we have 2 PA1410 on two different buildings. They act in an active-passive cluster. On each location is a switch, and the Firewall ist connected with all of its port (ha1a, ha1b, ha2, MGM, Data) to the switch. The switches are connected though a glasfiber to each other. Does it make sense, to buy a fiber sfp transceiver for each firewall and connect a ha1-link directly to the other firewall? Then  the HA1 Link is connected through the HA1A Port to the switch and Backup HA1 Link is connected through a sfp Transceiver directly to the other system.  I would say it would depend on how the 2 buildings are already connected to each other and how much do you trust that connectivity?   There was a time that my company's DC was split between 2 geographic location 180+ miles apart and we had a HA A/P FW split across that distance.  We used dedicated P2P fiber and we had no issues.  Only ever used HA1/HA2 and never used a backup link for HA.   We did use the management port as a heartbeat backup as a fail-safe.  Using this design as long as those P2P links between the DCs never went down we never had an issue with split HA across this distance.  In this design you can use copper or fiber locally as desired for your HA.  I don't really see a reason to pay for yet another fiber link from an ISP to support a HA-backup connection.   ... View more

@S.Dhuri wrote: Hi,    where is this setting     On the device tab towards the bottom.   ... View more

@S.Dhuri wrote: How Do I Enable Third-Party IDP For My Account?. (i.e. 3rd party IDP - CyberArk)   in am not able to see Authentication in setting page   is super-admin same as super-user   . You need to setup one of these then use this object in an authentication profile which is tied to the user account that you are trying to authenticate:   ... View more