About Brandon_Wertz

Hi, I don't know if this is a new feature not available back in 2020, but we could run HA1a and HA1b direct FW to FW over fiber on a PA-3260 without issue. (using ethx.x interfaces) Hope this could help if you want to avoid having a switch in the middle. Regards. ... View more

Hello,   You can block Google browser based game using Decryption and custom URL Filtering: (Im going to asume that you have already configured Decryption feature)   -Create a Decryption rule that match with www.google.com traffic -Create a Custom URL filtering that matches with www.google.com/logo and www.google.com/xjs (while you play at the browser, press f12 to see the resources that are needed to run the game) -Block this Custum URL Filter in the URL Filter profile that is used by your users ... View more

The worse of worse TAC support ever from both communication and skill perspective. ... View more

I read the entire thread. I wanted to fact the VM size, considering this as design principal that, SSL decryption consume high CPU, is there any SSL decryption sessions Vs throughput which could help to choose VM size(however due to this flexi consumption no more VM 3/5/700 but wanted to factor with rough estimate)    ... View more

Thanks for the additional info here! I have noticed Quic protocol coming through, but I can also replicate the issue on IE and Firefox.   We implemented SSL decryption for our users since the time of my first post, now all reddit related traffic comes through as "reddit-base", still no reddit-posting. PA verified that they can replicate the bug on their end, said they are looking into it with CON-50447. ... View more

I have also made an article about general issues with the remote access VPN and updated it as I have seen some major issues that come when "Enforce GlobalProtect for Network Access" is used or the captive portal is with ssl self signed cert:     https://live.paloaltonetworks.com/t5/general-topics/knowledge-sharing-community-account-fix-and-globalprotect/td-p/441311 ... View more

Been a couple years and I'd like to think we have come a long way on a better way to handle this. I'm dreading the future when we all go IPv6 if PANOS isn't updated to handle DNS wildcards in security policy / fw rules; I think we all understand the days of filtering by IP are limited with IPv6 and the every expanding CDN networks / cloud. ... View more

Hi people. Our customer faced the same problem in PAN-OS 9.1.9. It uses the PA-820 models in active-passive mode and dedicated HA ports. ... View more

Also facing same issue, ... View more

@Ram_Bista    Thanks for updating the post.   Regards ... View more

Update to this article for 8.1 and above. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLjPCAW ... View more

Hi all,    despite my efforts and re-installation attempts, the software keeps showing the very vague message of: Unable to establish a new GlobalProtect connection as a GlobalProtect connection is already established from this Linux system by the same user or another user.   Any attempt of installation/removal finish with same result. Any information about how the application "knows" if there is any other connection running would be great.    I have noticed that this issue happens if you try to run an automated installation (when no other use than root is logged) and there is no possibility later on of escaping from this loop of "connection is already stablished"   I have compared two installations (one where is working and other where no) with same operating system version and I cannot spot any difference.    Any clue why the software answer this annoying message all the time, while, as above has been suggested, if I run the command as root it just get stuck?     ... View more

Dear all,   Just for information if someone has the same problem, because we had solved our problem.   GlobalProtect client doesn´t set the Connection-specific DNS Suffix, it set the DNS suffix search list only for the network device. One option is to set the Connection-specific DNS by yourself in the network device or to add your ConfigMgr servers in hosts file (including DNS suffix) - Yes, both options are workarounds only, but they will work.   I hope this helps someone with the same problem.   ... View more

Just incase anyone is interested, a Blog has been written to help with this topic here: https://live.paloaltonetworks.com/t5/blogs/why-is-smb-traffic-slow/bc-p/357967   Be sure to check it out. ... View more

@Ram_Bista    I do not believe you will find that SSHv1 has been discontinued.  I think it is up to engineers to know and to deprecate SSH v1, to only allow the FW to communicate via SSH v2 ciphers.   Thanks ... View more