About Brandon_Wertz

@mss.support wrote: Cool, thank you. Trust me it was a bummer when I found this as well.    "Application routing" devices like touted in SD-WAN solutions / Meraki, Viptela, or even Riverbed's SteelConnect tout application based routing.  I've not really delved into these solutions, and can't understand how there isn't some sort of a hit as application shifts occur which could change a routed path.  That said I would love it if Palo could use a similar solution. ... View more

@Steven10th wrote: I got your points but did not quite catch "Why public cloud users did not need Palo Alto before ?" Security awareness rises in public cloud? So public cloud users suffered for years and did not aware. And somehow they begin to aware recently?   Yes   @Steven10th wrote:   ... Or the 3rd party security solutions needed for years in public cloud but there were technical barriers. And we got big technical breakthrough to enable 3rd party security solutions on public cloud recently?   Technical barriers?  Probably partially...An industry/service was created and security solutions evolved to operate in the new domain/ construct.   @Steven10th wrote:   ... ... ...Public cloud providers will try to offer their build in public cloud security solutions? So public cloud provider just let 3rd party security solutions in their cloud Market to see whether customers want to pay. And public cloud provider will offer same security solutions once needs are confirmed. By this, there never will be never popular 3rd party solutions in cloud Market place. “Why public cloud users did not need Palo Alto before ?", because the public cloud provider offered (and will offer)all the customer needs once the needs are conformed     Public cloud providers can / do offer "security solutions," but they aren't multi-cloud solutions.  Heck they likely aren't even "multi-product" solutions in the same cloud.  So if you can use a security product that works for multiple applications in a multi-cloud environment that is a much better solution for companies to invest in.  Vice have 4+ different solutions that they need to maintain. ... View more

@Sanssj wrote:     We are using  windows user-id agent for parsing the user and user group mapping info. often i see in the logs that the user is being not recognized and hitting the deny rule.  after couple of minutes it starts recognizing the user and allows the traffic   ...   I can come up with at least 3 different reasons as to why this could be happening from my own experience, but that might not be the case for you.  Can you elaborate on your auth set up more?  Have you tried looking into the aging timers and comparing that to the users that are having issues? ... View more

which cert we need to see the contents of traffic which is ssl decrypted via pcap? ... View more

Is your UIA service actually being "ran as" a service account with rights to get logs from the DC?  Does the UIA application have the correct service account ID/PW in the application?  (BTW if you set the DC for the service account to have the right permissions on the DC that service account doesn't need to be a domain admin...and it's good security practice for it not to.)   If you follow the steps (step by step) on setting up UIA you shouldn't have any issues.     I have 4 UIAs in my environment.  Have had them for the past 5 years and haven't run into a problem other than not having the right ID and PW.   Also make sure your UIA version is installed on the right OS platform. ... View more

I recently stood up GP in my company following the same general setup you have.   We do certificate based authentication for everything (Internal and External portals).     We are always on No split-tunneling Use internal host detection Use pre-login Use an internal gateway (but don't force interal traffic through the gateway) Certificate base authentication to internal and external GWs (This allows for no user interaction to connect) We have an internal PKI which signs our GW/Portal certs and issues machine certs   We have no issues with user connecting at home or in the office.  If your users aren't even connecting it sounds like you have somethign wrong if authentication.   If they're connecting to the external GW when they're internal it sounds like you have a timer issue.   ... View more

@BeKindPleaseRewind wrote: Apparently there's something called a Commit button you have to click after making changes.   Thanks   haha that's great...Happened to me before doing CLI stuff. ... View more

Thanks, I am in the process of upgrading. ... View more

Hello, My colleague actually encounter similar problem, she was upgrading from 7.0.1 to 7.1.19 issue was with getting 7.1 base version onto pa200 using GUI, operation end-up with " upload file size exceeded system limit " Workaround:  Use the CLI (tftp/scp) to upload the 7.1.0 image to the firewall and then proceed with the upgrade as usual.   It was tested on couple pa200s and solved the problem, apparently this is known bug in 7.0.x.   Hope that helps someone.   Thanks. ... View more

PanOS 8.1.4 released. Fixed bug related to this discussion. IN 8.1.3 ports 2,3,4,6,7,8,10 functioning only in 1 G. My wan switch have only fast ethernet ports. ... View more

The VPN portal should be an external IP address or FQDN since the users are located outside, and they use external DNS servers like 8.8.8.8, and TCP/443 is used for communication between GlobalProtect agents and Portals, or GlobalProtect agents and Gateways. Also, UDP/4501 is used for IPSec tunnel connections between the GlobalProtect agents and Gateways. ... View more

Hello All - I practically tried to change the Source Interface for Netflow traffic as LAN interface, with the expectation to see the Netflow traffic originating from the Firewall will appear in the Traffic Logs.    It is not appearing in the log  under Monitor Section. In relation to this i have two questions?   1) If i want the Firewall to send a Netflow Traffic or Syslog of firewall Interface (WAN & LAN) , should i configure a Rule to allow the Firewall to send traffic to Netflow Collector? In this case, the Source Interface for Netflow is LAN interface and Syslog is Management Interface   2) To get the Logs of the above Traffic (to ensure the Firewall is generating Syslog/ Netflow), should i configure a Allow Rule with Log Option enabled?   thanks in advance/RB ... View more

Excellent news. While waiting for an answer here though ihave succesfuly configured it using a loopback interface on the FW (public IP on it, we have loads), and it all works ... View more

That's what I was hoping you'd say.  I don't use internal gateways, but that never seemed to affect internal host detection for me.   I'm going to spin this up in my lab right now.  Thanks for the help ... View more