About Brandon_Wertz

My guess is the auth code you're using is wrong, or your Palo account isn't tied to the company/account the auth codes are tied to? ... View more

I'll try to answer, but am not positive on what some of these would be: ENTITY-MIB::entPhysicalDescr.19 = STRING: NP  -- (No clue, maybe Network Processor) ENTITY-MIB::entPhysicalDescr.20 = STRING: CP --  (No clue, maybe control plane) ENTITY-MIB::entPhysicalDescr.21 = STRING: DP0/CE -- Dataplane 0 (Not sure what CE would be) ENTITY-MIB::entPhysicalDescr.22 = STRING: DP0 Core -- Dataplane 0 (not sure what the "core" indicates) ENTITY-MIB::entPhysicalDescr.24 = STRING: Switch -- No clue ENTITY-MIB::entPhysicalDescr.25 = STRING: CP Core -- No clue ENTITY-MIB::entPhysicalDescr.26 = STRING: Switch Core -- No clue ENTITY-MIB::entPhysicalDescr.27 = STRING: NP Core -- No clue ENTITY-MIB::entPhysicalDescr.29 = STRING: DP1/DP2 -- Dataplane 1 and dataplane 2 (The 5200 has multiple dataplanes) ... View more

@S_Williams901 wrote: That is what I do now. But watching a demo on connecting actual clients to the firewall and assigning the ports to vlans, then using the vlan tab in interfaces, they created a IP created vlan "interface"   Like @BPry has previously mentioned the L3 VLAN can just be a sub-interface of an aggregate-ethernet (AE - Palo Port-Channel.)  While you might have seen other videos online that tie a L3 VLAN to a physical port that is ONE way to do it, but not required.  You can have 40 L3 VLANs as a "sub-interface" on a single AE or singular port if desired. ... View more

Is there a reason why you're running PAN-OS version 11.0.X?  If there's not a specific feature that's in 11.0.X and you can run 10.2.X my suggestion would be downgrade to 10.2.7hx or 10.2.8.  If you need to run 11.0, I would run the latest preferred version of 11.0.  Especially with the new 3400 platform I've ran into a bunch of weird issues. ... View more

@Upadhyay wrote: Can we configure a VPN gateway for cisco anyconnect via Paloalto FW ?     If you're asking if you can point a Cisco AnyConnect client to create a VPN connection to a Palo Alto VPN (GP Gateway) then the answer is no.  It's not possible to create that type of tunnel. ... View more

The part where both portals pointing to the same DNS name seems to be weird and I would think would cause problems, especially with certificates.   I would have the 1 portal point to both gateways, or have 2 unique portals pointing to both gateways.  There is probably an issue with 2 unique gateways on 2 unique firewall environments with different IPs.  ... View more

I can't speak to the "CSC" part of your question, but I can tell you the call out is specifically because your rule allows ANY application over ANY port. I'm not suggesting this rule as deployed in your organization is wrong for any particular reason.  This alert in the BPA report is suggesting that in a lot of use cases such a rule (any -- any) isn't suggested and should be restricted to defined applications over specific ports (Either app-default, or some other defined application.) ... View more

@Saurabh1 wrote: vsys -> vsys1 -> application-status -> tiktok 'tiktok' is not a valid reference vsys -> vsys1 -> application-status is invalid Commit failed   Getting error after new content version installed but when reverted issue fixed. This error comes from the scenario that @Claw4609  mentioned.  This will only happen when you're using an application in policy that isn't in the Application database of the firewall/Panorama. Make sure the application is viewable in the 'Objects' --> 'Applications' view.  If it is, try any variation of the following: Delete the current content version for Apps and Threats, then reinstall. Download and install a newer Apps and Threats content version. Where the application is used in policy, remove it from the policy and commit to the firewall.  Then re-add it back to the policy it was in then commit. ... View more

There are videos on how to activate software credits.  Have you looked at these? https://www.youtube.com/watch?v=kkBymf1Gstc&list=PLD6FJ8WNiIqUGkaxByd_2jIoTBOXvB1dD&index=3 ... View more

@Claw4609 wrote: Ive tried editing registries under here Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings. Specifically trying adding connect-method either pre-logon or userlogon and flipped the on-demand key to no but no combination so far has gotten GP to initiate a connection. And I have restarted after each of these changes.   In the debug logs Im seeing: "on-demand mode, should try retrive cache again without make connection"   But Im not sure why it keeps thinking its on-demand   Is there a cli/powershell command we could run to tell the clients globalprotect to connect?  I think the settings you're looking for are defined here: https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/globalprotect-apps/deploy-app-settings-transparently/customizable-app-settings/app-behavior-options#id51e0e000-9cce-425d-a4fd-e7fe51e1c8fb   If the endpoints are connected/managed from SCCM you can create a package to uninstall and reinstall the GP client coupled with a reboot.  When the client reboots the OS will automatically try to connect to it's defined portal to get the app config.  When it does this the machines will get the config updates you're wanting them to have. ... View more

@Claw4609 wrote: This would only apply to people that connect to Globalprotect correct? The main issue we have is the people who just dont connect to GP at all or havent in months. We have some internal gateways spun up in non-tunnel mode for the purpose of user-id/hip and I would like to begin retrieving this information via globalprotect from all clients. Yes, this setting would require the users needing to first connect to get that update. ... View more

@Claw4609 wrote: Ive tried editing registries under here Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings. Specifically trying adding connect-method either pre-logon or userlogon and flipped the on-demand key to no but no combination so far has gotten GP to initiate a connection. And I have restarted after each of these changes.   In the debug logs Im seeing: "on-demand mode, should try retrive cache again without make connection"   But Im not sure why it keeps thinking its on-demand   Is there a cli/powershell command we could run to tell the clients globalprotect to connect?  How are you connecting to these remote devices to make these registry changes if their VPN isn't enabled?  I'm not certain what the potential CLI/PS command would be to force this. ... View more

I'm not exactly certain if this relates to everyone's issue here, but I think the commit failures have something to do with a database schema change when Panorama is upgraded to PANOS 10.2.X.  I could be wrong but I heard that the database schema changed from 10.1.X to 10.2.X.  It's this schema change that is creating the inability to do "partial" commits and is requiring full commit.   If this is in-fact the problem I don't know if it goes away if managed firewalls are equal to or above PANOS 10.2+ ... View more

@E.Berrocal wrote: We use Palo Alto firewalls PA3020.  How can I generate a report that shows how many times a URL has been visited?  Also, can we see who visited the URL?  Thanks! If you're looking to do this to determine someone's "productivity" or define what someone might have been doing in a given time window Palo's URL logs aren't necessarily going to be the best route.  There is a lot of nesting that happens with websites.  Someone might be going to "ESPN" as example but there could be a widget on the page that links to Facebook.  Palo will create a hit for that user going to Facebook, when in reality the site they visited was ESPN and not Facebook.   So my call out is be careful for using a URL report as proof of someone's Internet activity.   That said you can easily create the report in: Monitoring --> Manage Custom Reports --> Create your custom report.     I've highlighted the fields you'll want to adjust depending on what you're looking for.  You can also use the query builder below to get more specific on what you're looking for.   ... View more

@Mahendran.M wrote: Hi Team,  One Visa processing URL blocking under Music category in my firewall. I ready added the this site into allowed list. But still blocking under music category. How to allow this URL make acces withough enable music category.  We would need to see the security policy, the URL profile and the custom URL category being used as well as the deny logs of the traffic.  My guess is the custom URL cat you used to allow the site isn't matching and is being denied in the rule.   Have you tried doing a URL recat request?  https://urlfiltering.paloaltonetworks.com/ ... View more