About TomYoung

Hi @Sanjay_Ramaiah ,   What do you have configured for your Primary Username under Device > User Identification > Group Mapping Settings > User and Group Attributes?     That should fix the problem.  If not, there are a couple other options:   Many SAML providers allow you to change the username format in their configuration. Normally, you could adjust the User Domain and Username Modifier fields in the authentication profile, but SAML is different.  I wonder if modifying the User Attributes in SAML Messages from IDP would fix it? Thanks,   Tom   Edit:  Forgot to post URL -> https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/user-identification/device-user-identification-group-mapping-settings.   ... View more

Hi @ian.whittington and @DDmchk ,   Here is my use case.  I use a "global" template to push my GP config out to all NGFWs.  There are 7 items that are unique to each NGFW:   Portal interface Portal IP address* Portal external GW FQDN* Gateway interface Gateway IP address* Gateway tunnel interface Gateway IP pool* It works great.  I could use a variable for every item marked with an *.  I cannot for the interfaces.  Because I cannot use variable, I have to override the template stack configuration for every NGFW (or HA pair).  Once overridden, some new configurations have to be added to each template stack configuration many times as opposed to the global configuration once.  If I could use variables for the interfaces, I can go back to the configure-once, push-to-all design.   UPDATE:  I used variables for the portal agent external gateway configuration, and then I reverted the agent section only in the template stack.  Now any agent changes are pushed to all. Thanks,   Tom ... View more

Hi @AkashThangavel ,   It is saying that a shared object on the NGFW will remain a shared object regardless if it is in the Panorama Shared device group or not.  Remember, they are not the same thing.  Think of the Panorama Shared device group as a global device group.  It has nothing to do with the NGFW shared context on the NGFW.   Thanks,   Tom   Thanks,   Tom ... View more

Hi @AkashThangavel ,   If you do not have any objects in Shared on Panorama, you could have a lot of redundant objects across your device groups.  If you want to make changes, you may have to change the same object in multiple device groups.  Creating a device group hierarchy https://docs.paloaltonetworks.com/panorama/10-1/panorama-admin/panorama-overview/centralized-firewall-configuration-and-update-management/device-groups/device-group-hierarchy allows you to make changes once and push to all NGFWs.   Thanks,   Tom ... View more

Hi @AkashThangavel ,   I understand your thought process.  Unfortunately, the Shared device group on Panorama is not the same thing as the Shared location on the NGFW.  The Shared device group on Panorama is shared across all NGFWs.  You can see the hierarchy in Panorama > Device Groups as mentioned in my 1st post.   So, if you uncheck the box when you import the NGFW configuration, the objects will be imported only into the device group, but they will still be in the shared location on the NGFW.   The best practice to import the objects into the Shared device group on Panorama is to allow you to eliminate redundant objects across your devices groups.  You can modify an object once for all devices.  Hopefully, I cleared up what the box in your picture is explaining.   Thanks,   Tom ... View more

Hi @AkashThangavel ,   Could you clarify what you mean by "impacted the other firewall configurations"?  All configuration in the Shared device group is pushed to all NGFWs since all device groups are subordinate to Shared ( see Panorama > Device Groups ).  The only exception is if you have Share Unused Address and Service Objects with Devices unchecked under Panorama > Panorama Settings.  In that case, objects will only be pushed to NGFWs if they are used.   Thanks,   Tom ... View more

Hi @tinhnho ,   I'm sorry.  I should have said Panorama > Device Deployment > Dynamic Updates > Schedules.  Could you check that?  Once we get that answer, then I can answer the other questions.   Thanks,   Tom ... View more

Hi @tinhnho ,   If the device is getting automatic updates and it is not configured in the template, then it is configured locally or pushed from Panorama.  What is configured under Device > Dynamic Updates on the NGFW?  What is configured under Panorama > Device Deployment > Dynamic Updates?   Thanks,   Tom ... View more

Hi @RichMauger ,   Setting the interval to real-time allows the NGFW to "access the signatures as soon as they are generated" by the WildFire cloud.  https://docs.paloaltonetworks.com/wildfire/u-v/wildfire-whats-new/wildfire-features-in-panos-100/wildfire-real-time-signature-updates  If you set the interval to 15 minutes, you can have up to a 15-minute window in which you are not protected from an unknown threat.  Of course, before the threat was detected in the sand box, you were unprotected.   How significant is that window?  I don't know, but the engineers at PANW changed the lowest interval from 5 minutes to real time for a reason.   Thanks,   Tom ... View more

Hi @tinhnho ,   Great question.  The PANW best practice is to "attach security profiles to all Security policy rules that allow traffic."  This includes the WildFire security profile.  See 1st paragraph -> https://docs.paloaltonetworks.com/best-practices/9-1/internet-gateway-best-practices/best-practice-internet-gateway-security-policy/create-best-practice-security-profiles.   I use security profile groups so that I can make changes in the group rather than having to change every allow rule.   Thanks,   Tom ... View more

Hi @TonyDeHart ,   That makes sense!  Please let me know if that works.   Thanks,   Tom ... View more

Hi @TonyDeHart ,   I have done NAT many times for IP addresses in the same subnet as the outside interface, and I never had to add the /32 IP to the interface.  You should not have to do that.  That is either a bug or double check your subnet masks.   If you are NATing to an IP address that is not in the subnet of the IP on the outside interface, you will need to add a route on the NGFW.  In your case, you have done step 2 of this doc ->  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGZCA0.   Thanks,   Tom ... View more

Hi @TonyDeHart ,   Are the NATed IP addresses in the same subnet as the original IP address on your outside interface?   Thanks,   Tom ... View more