About TomYoung

TomYoung · ‎12-28-2023

Hello @AAlabed , With regard to Expedition, please send an email to fwmigrate@paloaltonetworks.com, and someone will get back with you. Thanks, Tom

TomYoung · ‎12-26-2023

Hi @ccortijo , Traffic from the untrust zone to the interface in the same untrust zone is allowed by the intrazone-default rule. The easiest way to solve your problem is to create a drop rule (which will be above intrazone-default) that will drop all countries you do not want. Rule Type: intrazone Source Zone: Untrust Source Address: List you countries you want to allow and check Negate. Destination Address: Portal IP (could also be any if you want to block for all public IP addresses) Application: Any Service/URL Category: Any Action: Drop You can choose not to log if you don't want the clutter, but you may need to enable for troubleshooting. You can also stop 99% of the brute force attacks by disabling the portal login page. Thanks, Tom

TomYoung · ‎12-26-2023

Thanks @JayGolf ! Check out the post in the link above or below. @securehops has posted 5 "load config partial" commands that we used! https://live.paloaltonetworks.com/t5/general-topics/move-firewall-to-new-panorama/m-p/539747 Thanks, Tom

TomYoung · ‎12-20-2023

Hi @securehops , Your from-xpath should be /config/devices/.... The fact that TAC didn't point that out is interesting. Load config partial can be a pain to learn, but once you do you can save a lot of time. Your scenario is a perfect example. Merging the configuration will be a lot quicker than pushing the config locally for all your devices and importing them. With regard to import, there are a couple gotchas to be aware of. Thanks, Tom

TomYoung · ‎12-19-2023

Thank you. That's not terrible to move them one at a time. Sorry for the misunderstanding.

TomYoung · ‎12-19-2023

Hi @securehops , Exactly. That's what I had in mind. I'm sorry. How many device groups and templates do you have? You could try the load from-xpath with just /device-group/ and /template/ without the /entry/.... That would may also merge the shared device group which may be what you want. Thanks, Tom

TomYoung · ‎12-19-2023

Hi @QuickShot , Disabling the portal login page eliminated all of the bogus logon attempts for me. You can enable it only when needed. Thanks, Tom

TomYoung · ‎12-19-2023

Hi @securehops , In the scenarios in the link, you load the config from a file. The XML API only shows the running-config. You can use the API to get the generic XML Path (XPath), and change the name of the device group or template that exists in the configuration file. You may need to go through the link again. Thanks, Tom

TomYoung · ‎12-19-2023

Hi @securehops , Here is the link for "load config partial" again. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClbLCAS Thanks, Tom

TomYoung · ‎12-04-2023

Hi @Coforge_BPS , You can view most capacity numbers on this page -> https://www.paloaltonetworks.com/products/product-selection. Thanks, Tom

TomYoung · ‎12-01-2023

Hi @chens , Yes, it is possible. The only thing you need to do to configure GP client certificate authentication AND username/password/MFA is as follows: Install the certificate on the client (step 4 in the link below). It could be unique for each client or the same. Create a certificate profile (step 5) and select it on the bottom of the Authentication tab of the portal and/or gateway. Make sure the Client Authentication configuration has "No (User Credentials AND Client Certificate Required)" selected for "Allow Authentication with User Credentials OR Client Certificate." https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/globalprotect-quick-configs/remote-access-vpn-certificate-profile#id0da833e2-8485-4e10-a6a6-9e488c39b6fa That's it! Thanks, Tom

TomYoung · ‎11-29-2023

Hi @Raphael , You have a community account. Do you have access to your company's support account? If so, you can download the GP client. I think the default NGFW configuration is not to force the client version when you connect. You should be able to decline the downgrade if prompted unless your IT has configured it to force. Thanks, Tom

TomYoung · ‎11-29-2023

Thanks @reaper ! I thought I replied, but I guess I didn't.

TomYoung · ‎11-27-2023

Hi @bpotter98 , Traffic from the untrust zone to the interface in the same untrust zone is allowed by the intrazone-default rule. The easiest way to solve your problem is to create a drop rule (which will be above intrazone-default) that will drop all countries you do not want. Rule Type: intrazone Source Zone: Untrust Source Address: List you countries you want to allow and check Negate. Destination Address: Portal IP (could also be any if you want to block for all public IP addresses) Application: Any Service/URL Category: Any Action: Drop You can choose not to log if you don't want the clutter, but you may need to enable for troubleshooting. Thanks, Tom

TomYoung · ‎11-26-2023

Hi @Mohamad_1221 , The problem most likely is that the above URL redirects to an AWS URL which is 373 characters long. The maximum size for the EDL Source field is 255. To demonstrate, I pasted the AWS URL in the field below: I solved this problem by fetching the Talos list here -> http://opendbl.net/. It keeps the list up-to-date. I still use it now, but sometimes I run into certificate issues with that site. Thanks, Tom

Member Since	‎11-15-2017 11:37 PM
Date Last Visited	‎04-19-2024 03:08 PM
Posts	1,139
Total Likes Received	463

Online Status	Offline
Date Last Visited	‎04-19-2024 03:08 PM

Unlock your full community experience!

About TomYoung