About Harshit

could you Please provide a screen shot of what you are getting? ... View more

Ok, makes sense now,   To achieve this, i would put Global Protect and VPN tunnels in seperate zones, and then we can use virtual router in order to route the traffic from one zone to another, and use Security policy to restrict it to specific ip and port too.   In a nutshell you need:   1) global protect 2) b2b tunnel to PCI 3) seperate zones for both mentioned above 4) security rules to allow traffic between these two zones.   if you need help setting either of these i can provide you links to them.   ~HTH     ... View more

if i am assuming correct,    you are using one public ip and you are planing to use port 80 for webserver.   To set this up i would set up two different Nat statements, one for outbound only, that will translate your internal network to public ip, it would look something like this:   for outbound Nat:   security rule :   source ip : your internal ip destination ip: any source zone: trust destination zone :untrust service : http   Nat policy:   source ip : your lan ip source zone: internal detination ip : any destination zone: untrust source Nat  to untrust interface ip     for inbound web server:     security rule :   source ip : any destination ip: <your public ip> source zone: untrust destination zone :trust service: http   Nat policy:   source ip : any source zone: untrust detination ip : your public ip destination zone: untrust destination nat : internal web server ip     ~HTH ... View more

you probably do not need IKEv2 for global protect, Scenario:1 you already have a anyconnect client, coming in on an ASA, then it routes to a PaloAlto firewall that has a VPN tunnel and the traffic flows through it, If true, you should be able to configure Paloalto to use SSL and then reroute the traffic through VPN (B2B) tunnel.   Scenario: 2   you already have a anyconnect client, coming in on an ASA, then it routes to a ASA firewall that has a VPN tunnel (U-Turning the traffic)  and the traffic flows through it, If true, you should still be able to configure Paloalto to use SSL and then reroute the traffic to the ASAand eventually VPN (B2B) tunnel, you would just need to make sure routing is set properly on both firewalls, my suggestion would be to use seperate set of pool ip addresses for both.   If there is another scneraio, let me know. ~HTH ... View more

Hi,   I believe The Apps in the group would be "OR" (ed) , similary you can put "ssl" and "web browsing" in a rule and that matches both type of traffic.   Regards,   ~Harry ... View more

thanks ,   it appears to be version fix for the vulnerability, i am looking a stable version over all.   regards,   ~Harry ... View more

i think you are putting this in the wrong thread 😛 ... View more

I tried different options and only anti-virus would show me all the firewalls, i guess it's license issue on the host device,   give it a try,   ~Harry ... View more

I could not locate the model information, but i would suggest you compare the speed supported by the model and keep an eye on "CPU meter" at the home page to see if it spikes while file transfer.   Regards, ~Harry ... View more

it works, thanks   ~Harry ... View more