About TomYoung

Hi @Aewald785 ,   If you are not using static routes, you probably are using BGP with the default route only, the ISP should remove the default route if they have problems upstream.  You bring up a good point.  How many ISPs don't remove the default if they have issues?  If that is the case, what is the advantage of BGP over static routes if the dynamic default route doesn't work or if you cannot receive the full Internet routing table?   I really wanted to come up with a way to use BGP conditional advertisement to solve your problem, but it will remove the advertisement and not the local route.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEUCA0   Thanks,   Tom ... View more

Hello @Metgatz ,   I have setup GP for many customers and never had to login twice.   Do you have different authentication profiles for the portal and gateway?  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClQXCA0 Are you using MFA?  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cmm3CAC  The simple solution to MFA is to configure it for the portal or gateway only. Another thing you can look at is cookie authentication.  https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/authentication/about-globalprotect-user-authentication/how-does-the-app-know-what-credentials-to-supply/cookie-authentication-on-the-portal-or-gateway.html Thanks,   Tom ... View more

Hi @aerspa ,   I have run into similar issues before where the auto-commit fails.  I usually do a commit force on the CLI and troubleshoot from there.  In this case, it looks like your auto-commit is stuck.  Could you try clicking "Stop Job" for the auto-commit and then "commit force" on the CLI?   Thanks,   Tom ... View more

Hi @FWPalolearner ,   Yes, you have to download 9.1.0 first.  Then download+install 9.1.11.  Check out the Upgrade Procedure under step 4 here -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRrCAK#anchor4.   Thanks,   Tom ... View more

Hi @mkinneyita ,   Here is a great article to transfer a device in the support portal -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClNQCA0.  You may need to take additional steps for legal transfer.   Thanks,   Tom ... View more

Hi @OwenFuller ,   You can verify the XMP path by logging into the XML API Browser of Panorama at x.x.x.x/api.  Then drill down into the menu tree (e.g., Commit > all > shared-policy etc.) and you will see the XML API URL on the bottom of the web page.   Thanks,   Tom ... View more

Thank you!   This is a great community! ... View more

Hi @FWPalolearner ,   Good news!  Excellent work.  Try making a change and committing to see if the GUI error goes away.   Thanks,   Tom ... View more

Hi @FWPalolearner ,   That is very strange.  I have the Advanced URL Filtering license, and my license page shows the Advanced and PAN-DB good.  I guess you need to open a TAC case.  Thanks for the pics!   Thanks,   Tom ... View more

Hi @LCMember2099 ,   Ensure the subnet of the DHCP pool matches the interface IP address to which the pool is configured.   Thanks,   Tom   PS Delete the unused cert with the duplicate CN and enable IPv6 under tunnel.2 to get rid of your 2 warnings.  You do not need to supply an IPv6 address.  Just check the box. ... View more

Hi @kapildev87 ,   When you say "login works fine" I assume that you mean the web login on the portal?  If so, then check your traffic and system logs (or GlobalProtect logs for 9.1+) for dropped traffic or errors.  If you can't find the issue there here are in-depth troubleshooting steps -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClkBCAS.   Thanks,   Tom   ... View more

Hi @Justin.Pantalleresco ,   You cannot disable the message box, but if you disable IPsec as an option under Network > GlobalProtect > Gateways > [gateway-config] > Agent > [agent-config] > Tunnel Settings, then you will not get the message.  Full details can be found here -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000001Uh1CAE&lang=en_US%E2%80%A9.  I have done this on one of my firewalls will a slow Internet connection, and GP works great without the message.  Most people have no idea if they are using IPsec or SSL VPN.   Thanks,   Tom ... View more

Hi @FWPalolearner ,   Scroll down on this link -> https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/datasheets/integrated-url-filtering-datasheet and you will see a table of the features in URL and Advanced URL filtering.  The 1st line, "URL filtering database" is PAN-DB.   A license expired message is not normal.  You may need to "Retrieve license keys from license server" under Device > License.   Yes, you can test URL categorization on the NGFW.  Use the "test url" command on the CLI -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClQcCAK.  On the bottom of the link it has special PANW URLs you can test for each category.   Thanks,   Tom ... View more

Hi @GnContente ,   That is strange.  Usually the system log tells you why the tunnel went down in the Description column.  It is possible it does not in this case.  What exactly does the log say?   Thanks,   Tom ... View more