About TomYoung

Hi @Shahlar ,   You said, "we just obtained CA certificate for SSL decryption for testing purposes".  Was this a public certificate and did you also get the private key?  I have never heard of a public certificate authority issuing a CA certificate to a user.  Then the user could issue certificates on their behalf, defeating the whole purpose of a trusted CA.   The issue is not that there is no point to using public CAs for SSL Forward Proxy.  You can't get a public CA certificate and private key.  If you have one, I am very curious how you got it.  Maybe I am missing something.   Thanks,   Tom ... View more

Hi @Ankit1Singh ,   Please run the commands on the managed NGFW.  The commit is failing there.  As long as you have not reverted the configuration, the Panorama pushed configuration is still part of the candidate configuration.  You can still try to commit it.   Thanks,   Tom ... View more

Hi @Ankit1Singh ,   Could you run the CLI command "show system software status | match sslvpn" and confirm the process is running?  If not, you can restart the process with the CLI command "debug software restart process sslvpn".  Then commit again.   Thanks,   Tom ... View more

Hi @JeffH-SecBBQ ,   There is a way to set up the NGFW to authenticate administrators based on group membership so you don't have to create unique admin user objects.  It is done under Device > Setup > Management > Authentication Settings.  Notice that it supports only RADIUS, TACACS+, or SAML.     The reason, I believe, is because those protocols can also specify the role to be used in addition to authenticating.  With local admins, you specify the role.  With centralized admins, the authentication server needs to specify the role.  You could have one group for superusers, one group for read-only superusers, etc.   With RADIUS, the roles are configured with VSAs.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIxCAK   Here is the dictionary.  https://docs.paloaltonetworks.com/resources/radius-dictionary   Thanks,   Tom   ... View more

Hi @SteveBallantyne ,   Probably because the only CA certificates on your NGFW contain private keys.  It only allows CA certificates to be installed.  You can add public CA certificates with no private key.   Thanks,   Tom ... View more

Correct.  Last time I checked, I could not use variables for items 1, 4, and 6 listed above.  Those do not have an asterisk. ... View more

Hi @YannickMaes ,   I configured a bogus interface in the Global template.  I then overrode that interface in the template stacks with the correct interface.  Trying to use the same interface in the Global template led to problems as it interfered with the templates.  You can send me a PM if you want to see the config.   Thanks,   Tom ... View more

Hi @KGH0511 ,   Thank you for the feedback.  That is the opposite of what I saw in the documentation, also.  It does make sense the a NAT lookup is done on ingress, but the NAT is applied on egress.  The NAT lookup is why the destination zone in the security policy rule is toward the server.   Have a great day!   Tom ... View more

Hi @KGH0511 ,   Good!  This is progress.  As I mentioned before (and is mentioned in the doc I linked), the destination address in the security policy rule should be the public IP address from the NAT rule.  Please try making that change and let me know if it works.   With regard to no traffic logs, did you enable logging for the interzone-default rule?  You will need to use the Override button.   Thanks,   Tom ... View more

Hi @KGH0511 ,   It is strange that you are getting hits on your security policy rule.  The destination IP address should be the public IP address (pre-NAT).  The service should be 5900 (post-NAT).  Please see this doc.  https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/nat/nat-configuration-examples/destination-nat-exampleone-to-one-mapping   You could also try changing the destination interface to any in your NAT rule.   Thanks,   Tom ... View more

Hi @NilsGab ,   Every section of the PDF has the following counters:   Failed CSC checks Failed non-CSC checks Failed CSC and non-CSC checks So, there is some info.  I understand the format is not the same as the previous report which is shown in your screen shot.   This is a community forum, and I don't work for PANW.  You asked if you could get CSC info from AIOps BPA, and there it is.   Thanks,   Tom     ... View more

Sorry!   I forgot to mention that he/she never responded.  Maybe not familiar with personal mail in the community. ... View more