About VinceM

If using another client, say goodby to HIP, multi gateway and all these nice feature.   v.  ... View more

Hi all,   If it's another domain, for sure, it using an other DHCP scope. Then you just have to configure include/exclude network in User Identification / User Identification menu. Just include the DHCP scope you want to manage.   Rgds   V. ... View more

Hi,   Already did that. Look https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clc9CAC   Rgds   V. ... View more

Hi, Palo's FW is not a reverse proxy then If you are encrypted on one side, you must be ecrypted on the other site. Mean, you can't redirect https://mypublic-ip:7788 to http://myprivate-ip:8899 but you can do https://mypublic-ip:7788 to https://myprivate-ip:8899 with D-NAT (refer this doc: https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-admin/networking/nat/nat-configuration-examples/destination-nat-exampleone-to-one-mapping)   Rgds   V. ... View more

Hi, you can't 🙂   V. ... View more

In parallel, you can use EDL (https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/policy/use-an-external-dynamic-list-in-policy/external-dynamic-list) or URL custom cat (https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/url-filtering/custom-url-categories.html)   everything can be automatic with MineMeld (https://www.paloaltonetworks.com/products/secure-the-network/subscriptions/minemeld) - really powerfull tool   Rgds ... View more

Hi, How do you want to perform "automated submissions" ? on which criteria ?? You can find python script on github (https://github.com/stealthllama/pandb-query/blob/master/pandb-query.py). Maybe you can make some changes on it for re-categorization ..   Rgds   V. ... View more

Hi, When you say "First page, IE = Website’s security certificate warning page with options to continue (or on Chrome advanced and proceed to continue); then after we click the Continue button", where does this cert come from ?? Is it yours ?? If it's yours, mean you are decrypted then you don't match your "no-decrypt rule" If not, mean someone else make decryption. Look in the cert.   Rgds   V. ... View more

Hi Marivi, By default lacp is not enable. then aggregate work like an activ/passiv aggregate. With Lacp you can use all link in parallel.   Cheers   v. ... View more

Hi, Moving from one tenant to another one, mean new rules, new config then deplay a new agent (coming from the new tenant). For me, no other solution.   Cheers   v. ... View more

I, Don't really understand why you need source Nat in your tunnel but doesn't matter. If you want to source nat traffic in your vpn tunnel, either you select nat based on interface, select tunnel int then you tunnel IP or you  select translated Address and you give the IP you want. Of course, configure your nat as dynamic IP and Port.   Rgds   V. ... View more

Hi,   You have to know that before beeing able to indifty a complete app, your firewall nedd to first allow session's first packet. Mean allowing syn / syn-ack /ack + first apcket. At the beginning session identification is based on 5-tuple (source zone, source IP subnet, destination zone, destination IP subnet, destination port). Mean, based on this criterim, session match first security rule which allow these packet. If your rule is on top, it can explain strange traffic in your log. look: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClS9CAK   Rgds   V. ... View more

Hi,   No reason for syn on port TCP/445 to arrive on your server if you don't want it. But it seem your security rule allow it. what your security rule look like ?? Allow only app on application-default.   V. ... View more

Hi Mohammed,   Seem you are on public IP range on both your wan and your DMZ. then if you just want to allowed ping. You should only have security rule like from zone: WAN1-TATA  To zone DMZ-1 To IP 203.196.171.56 Application: ping  Service: Application default Action: Allow Your Internet-DMZServers rule should be TO LARGE 🙂 Incomplete mean, syn arrive to your server and your server never answer.   Rgds   V. ... View more