About TomYoung

Hi @ITforacompany ,   Have you configured Liveness Check under Network > Network Profiles > IKE Gateways > [edit gateway] > Advanced Options?  I have that set to 5 seconds on an IPsec tunnel to an FTD device which is has much of the same code as an ASA.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClgcCAC   The ASA may need the "crypto ikev2 dpd interval retry-interval" command configured.  I can't remember if it is default.   Thanks,   Tom ... View more

Hi @mistermat ,   What do you have configured under Network > GlobalProtect > Gateways > [edit gateway] > Agent > Client Settings > [edit client] > Split Tunnel?   Thanks,   Tom ... View more

Hi @Ustapon ,   You should be able to configure the NGFW with 2 portals, 2 gateways, and 1 certificate.  I configured 1 portal with 2 gateways and 1 certificate for a customer using this method -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClUhCAK.  This technique is not well known.  The FQDN is the same, but the port numbers are different.  A NAT rule is used to NAT traffic to the different gateway IP.  This may not be needed if you have 2 portals.   This guys says it is possible to have 2 GP portals on the same appliance -> https://live.paloaltonetworks.com/t5/general-topics/global-protect-with-multiple-portals/td-p/49657.  Again, that doesn't seem to be documented.   If you have two separate portals (one for each ISP) that only forward traffic to one gateway (on the same ISP) then I don't see why it wouldn't work.  They should act independently without a conflict in FQDN or certificate.   It would be cool if you could test it and let us know.  If you have ECMP, you need to enable symmetric return.   Thanks,   Tom   PS A more standard way of accomplishing this redundancy is to use a public loopback address that is advertised to both ISPs.  Then you only need to configure 1 portal and 1 gateway.  Again, configure symmetric return is ECMP is enabled. ... View more

Hi @SubaMuthuram ,   You're so close!  Please follow @reaper steps to delete the hip-profile commands and your commit should work.  Type in the show command as he specified.  Copy the set commands that follow to a clipboard.  Replace the 1st "set" with "delete" and paste into the CLI.  Type "commit".   Thanks,   Tom ... View more

Hi @SubaMuthuram ,   There may be config lines in the CLI that does not show up in the GUI.  Sometimes the upgrade does not convert the config correctly.  You can follow @reaper steps to verify.   Thanks,   Tom ... View more

Hi @danoman2 ,   You probably have "log at session end" configured for your security policy rules.  This is recommended.  Monitor > Logs > Traffic will only show sessions that have ended.  In order to see live sessions, go to Monitor > Session Browser.   Thanks,   Tom ... View more

Hi @SubaMuthuram ,   It looks like if you remove the HIP profiles from those security policy rules, the commit will succeed.  You can do that via GUI or CLI.  If you do it by CLI as @reaper suggested, replace the word "set" with "delete" in the command and paste it on the CLI.  You can type "commit" on the CLI when done.   Thanks,   Tom ... View more

Hi @Networking2017 ,   That upgrade plan looks good.  It is a good idea to review this doc -> https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/upgrade-to-pan-os-91/upgrade-the-firewall-to-pan-os-91/upgrade-an-ha-firewall-pair-to-pan-os-91.html .   Thanks,   Tom     ... View more

Hi @PranamShah ,   Yes, it is viable.   You can connect the ISP directly to the PA-220. You can connect your servers directly to the PA-220. Set the ISP interface to L3 in a L3 untrust zone with the public IP. Set your server interfaces to L2 in a L2 zone.  Put them in the same VLAN. Create a L3 VLAN interface tied to the L2 VLAN in a L3 trust zone. Create default route to ISP. Create DIPP NAT rule to outside interface IP from trust zone to untrust zone. Create security policy rule to allow traffic from trust zone to untrust zone. Thanks,   Tom ... View more

Thanks @Land-Salzburg !   What do the logs say on the MFA side? ... View more

Hi @Jamescy ,   I will answer the Palo Alto firewall portion.  As long as the security policy allows the traffic to the remote printer in the GP zone, it can be done.  You will need to setup the client computer shared printer to work.   Thanks,   Tom ... View more

Hi @Jamesy ,   This is the cmd= that worked for me.   <request><global-protect-gateway><client-logout><gateway>Gateway-Name-N</gateway><domain>Domain</domain><user>Username</user><reason>force-logout</reason><computer>Computer-Name</computer></client-logout></global-protect-gateway></request>   The computer may be required.  I got that from the example in the doc.  Maybe add it? My domain is displayed as domain/username.  So, no .com was needed.  Maybe try without? I don't know if order is important.  Maybe try the exact order? Thanks,   Tom ... View more

Hi @Jamesy ,   Wow!  The solution is not in the example here ->  https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-panorama-api/pan-os-xml-api-use-cases/show-and-manage-globalprotect-users-api, but it is in the response.   You need to add the <domain></domain> parameter.  https://live.paloaltonetworks.com/t5/automation-api-discussions/why-can-my-api-call-show-globalprotect-users-but-cannot/td-p/232802   I have tested this with Postman, and it works!  Without the domain, I get the same error as you.  Perhaps we both have logged in with AD accounts.  My Primary Username under Network > GlobalProtect > Gateways > Remote Users is domain\username.  I guess that parameter is required if a domain exists.   Thanks,   Tom ... View more