About Brandon_Wertz

@MP18 wrote: @MuhammadAbdeen    I tested with below rule and whats voice,video and that url does not work. Here is screenshot of that rule. Also the app whatsapp voice has below dependencies rtcp, rtp-base, stun, whatsapp-base   So you need to block these also.     @MuhammadAbdeen I would be careful in blocking these other applications "rtcp, rtp-base, stun" especially RTCP and RTP-base.  These are foundational to content presentation on the web.  So be sure blocking these apps will not have any unintended consequences.  (Make sure it's tied to the correct custom URL category, and intended user groups) ... View more

@sharam wrote: What I am seeing in logs related to the outage is:   But I am not able to see which rulebase this it related to. You're showing the detailed log entry.  (You've clicked the magnifying glass next to an entry in the threat log)  To better help point out why this is happening we need to see the main entry.  It looks like this is happening because of a VP profile which is attached to a security policy rule.   ... View more

@Jafar_Hussain can you explain a bit more about the circumstances around when you think CP should be presented when it's not?  It has been my experience that yes, for CP to work properly you will need SSL decryption.  In your authentication profile what enforcement mechanism do you have selected? ... View more

@pawelzwierz wrote: Here is feature list https://docs.paloaltonetworks.com/globalprotect/8-1/globalprotect-admin/globalprotect-overview/about-globalprotect-licenses.html Generally licenses are needed: - mobile devices - higher security - HIPS check - clientless   1. No, ip should be binded to interface. U can acheive it by configuring portal with loopback and NAT 2. Yes, exactly To add to what @pawelzwierz  and @BPry  mentioned.  Palo in the "unlicensed" version of GP provides a robust client based VPN.  There's really not anything lacking in this posture.  In the unlicensed version there's no restrictions on capacity or throughput HIP even works for alerting and awareness.    HIP enforcement however comes in the licensed version.  The clientless VPN portal also needs a license which is something you said you're looking for.  I think these two features alone should be able to help you justify the license purchase. ... View more

We've got GP being managed / deployed by SCCM.  GP connect method is pre-logon / always on.  We've done an initial deployment (4.1.6) 2 years ago, with a recent upgrade to 5.0.7 via SCCM all without major issue.   Like @BPry  mentioned what are you needing help with? ... View more

@VzServiceDesk wrote: Hi Everyone,    As per PA-3220 datasheet IPsec throughput can be 2.5Gps. https://www.paloguard.com.au/datasheets/pa-3200-series.pdf   The palo in my environment got  1 Gig interface (internet facing) and multiple ipsec tunnels are configured to communicate to different cloud providers without any rate limiting....so question is how to figure out what would be the actual throughput of the VPN tunnels  ? as the physical interface speed is 1G maximum..   You have 1 physical interface with a maximum throughput of 1G.   Let's say you have 5 IPSec tunnels connecting through this 1G interface.  The most the aggregate of these 5 tunnels will get is 1Gb.   1 tunnel might get 900Mb with 25Mb shared across the other 4.  Or any variation you could think of totally 1Gb, but the total throughput of your tunnels will never exceed 1G. ... View more

@RichardKnox wrote: Good morning, My company uses Global Protect for its connection to our corporate network when I work remotely. I recently been having issues where it says its connected, but only part of the applications are able to access the network. Skype works, I can see the local drives, access Projectwise, but Outlook (Microsoft exchange) keeps asking for a password. I have to go and reboot my ISP modem, shut Outlook off and then once Skype is back online restart Outlook and it connects just fine. I have a Arris Cable modem (MODEL: DG3270A) provided by my ISP. The only reason I am looking at Global Protect is there are times I will watch it connect/ disconnect multiple times in a row, before establishing a permenant connection. The modem is also a router that can be disabled, which I did because I already had a home router system installed in the house prior to having this "Upgrade" installed with the faster speed. So, please any suggestions?   Since you say, "my company," I'm guessing you don't own the VPN service.  It sounds like you should contact your company's network team to look into this for you. ... View more

@Jafar_Hussain wrote: @SutareMayur  I have tried this but it is not working as well as i have cheked with decryption but still same issue persists. In the traffic logs for the video content what's the application being defined as? ... View more

@AvinashKukkapalli wrote: Attached screen shots for reference I refer you to my posts in this thread.  https://live.paloaltonetworks.com/t5/General-Topics/PA-3260-and-using-non-dedicated-as-HA1-interface/td-p/308152   Are you trying to use a different pot for HA-1 because you need fiber?  HA-1 has to be used on the dedicated port. ... View more

@AvinashKukkapalli wrote: Hi Team , Can we route HA traffic between two 3260 firewalls through cisco switch using L2 vlan.  My requirement is to run firewalls in HA and devices will be in different buildings. Buildings are connected with dark fiber. As PAN dedicated HA ports are ethernet i have to use another converter or switch to make them communicate in HA ports.  i did l2 vlan on 9500 switch but HA1 never comes up. Can we do like this? Technically no, but you can switch the traffic...Ok, I'm done splitting hairs.   You 10000% can do this.  As long as both switches participate in the same layer 2 domain it should work without issue.  (This would also mean that the link the switches are connected has the access VLAN on the trunk the HA-1 ports are on)   Say you have FW-1 connected to SW-1 with the FW-1 HA-1 with the IP of 10.10.10.1 on an Access VLAN 10 to SW-1   You'd need FW-2 connected to SW-2 with the FW-2 HA-1 configured with the IP of 10.10.10.2 on Access VLAN 10 to SW-2.   You would do the same for HA-2 ... View more

@MP18 wrote: Yes it is a fiber connection connection between our Data centres for HA! Can you land this fiber into a switch?  Then plug copper from the switch into HA1? ... View more

@MP18 wrote: We have 2 PA 3260  across Data Centres. We tried to use Eth1/13 as HA1 port but under ha1 interfaces it does not show option to choose  eth1/13.   IS this by design that HA1 interface to be dedicated? for now we used management as ha1 interface.   is this good to use management interface as ha1?   Regards Mike Why can't you use the HA1 port even if the firewalls are across DCs?  (I'm guessing you're needing a fiber connection?)     I've got a 5220 pair spreed across 2 DCs that are 800+ miles apart using HA1 in a switched environment w/o issue. ... View more

Your question is kinda hard to follow.  What are you trying to understand?  The link you posted merely defines the zones you'd need to create in a Palo SD-WAN environment.  Those zones based on their name have a specific use case based upon their name. ... View more