About gafrol

Can this be done to the 2000 series as well ? ... View more

almost the same syntax set user-id-collector include-exclude-network ... View more

Yes take a look at https://www.duosecurity.com/ ... View more

We are monitoring these system parameters via snmp. Here is an example for the DP CPU. You can set an alert if CPU is above x% for the period of y minutes. and another example for total active sessions ... View more

Just another great solution we use for Global Protect and  2 factor authentication. The vpn users are authenticated against MS AD. It's called Duo Security, the users really like the push functionality and it is indeed very good value for the money. It's also easy to implement. https://www.duosecurity.com/duo-push ... View more

Forward does not mean that the file has been forwarded to the wildfire cloud ! Forward: The Wildfire cloud has already seen the file, thus no further action is taken on the file and no entry is seen on the wildfire portal. Wildfire-upload-success: The Wildfire cloud has not seen the file and the file is uploaded to the cloud for a verdict. Wildfire-upload-skip:  The Wildfire cloud has already seen the file and confirmed a verdict of "Malware" thus the file is skipped by the PA device, however a log is generated on the Wildfire portal Cheers Roland ... View more

The one thing that is nice about an outside entitiy like CPUG or PANUG would be that the content would be indexed by Google and would be accessible by anyone, regardless of the status of a support contract...I think that not requiring someone to have a support contract with a company is a big reason to argue in favor of such a community (be it CPUG or PANUG) - you exclude a lot of young aspiring firewall admins by requiring a support contract before you can log in to Palo Alto Networks' communities. Yes totally agree, but requiring a serial number to sign up for the community/support access keeps the crap out.. I really like the the expertise in this community, very high level and of great value for everyone ! ... View more

Not much content yet. I personally believe one PAN community is enough ... View more

I would not recommend to use the new agentless UID approach yet, - AD User Accounts with Umlaut characters cannot be excluded (Support case is already open) - It seems networks cannot be excluded from user ip mapping neither -- > https://live.paloaltonetworks.com/thread/6903 I had some strange behaviour with the agentless setup but which I could not reproduce in the lab. I would recommend to stick with the UID Agent for now. Just my two cents. ... View more

Maybe you could use the CLI command set user-id-collector include-exclude-network in order to exclude GP IP Pool 10.1.253.0/24 from AD IP usermapping ? rgds Roland ... View more

On which interface did you attach the QoS Profile ? ... View more

That's why I'm using Kerberos for authentication, it's much easier no fiddling around with bindings and samaccountnames etc. ... View more

Today I have configured and tested the Duo Security Two Factor Authentication with Global Protect and it works like a charm. All in all it took me about 45Mins. to get everything working (mostly because of waiting for the commit to be finished 🙂 Means installing and configuring  the Authentication Proxy Software provided by Duo on the Windows server, registering for a free Duo Account (up to 10 users free) and reconfiguring the PAN Firewall to use the authentication proxy as a Radius Server. I really like the Duo Push functionality which makes it very easy and secure for an enduser to authenticate to the GP VPN. I would love to see this integrated into the PAN Firewall out of the box as with this approach the authentication proxy would be obsolete. Roland ... View more