About TomYoung

Hi @Dadonis ,   You can have 2 virtual routers with OSPF running in each one.   Thanks,   Tom ... View more

Hi @FWPalolearner ,   The link is fixed now.   Thanks,   Tom ... View more

Hi @FWPalolearner ,   Have you tried disabling the portal page -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClbpCAC  I am curious if it will work.  It may not.  I viewed the source HTML of my portal, and I don't see version info.  The GP client and portal exchange versions in order to determine if a client upgrade is necessary.  I would hope that occurs after login.   Many of my customers use software distribution servers to roll out the GP client, and they do not need the portal.  You would use the method that works best for you.   Thanks,   Tom ... View more

Hi @Metgatz ,   It looks like you can according to this document -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGxCAK.  The only time it would work if you do not specifiy a gateway IP address is if you were forwarding the traffic to a point-to-point interface, such as a tunnel, where there is only one destination.  In the doc referenced, a dummy IP address is needed on the PANW side of the tunnel.   Thanks,   Tom ... View more

Hi @smelias ,   Not through any public documentation that I can find.  That is why I said that I don't think it is supported.   Thanks,   Tom ... View more

Hi @JorgeOrtega ,   Yes, that will worked based upon the allow list.  No, you shouldn't have to type it in manually as long as you can see it under  Device > User Identification > Group Mapping Settings > [edit group] > Group Include List.   Thanks,   Tom ... View more

Hi @JorgeOrtega ,   The authentication sequence should check both authentication profiles regardless of the AAA response -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PMdXCAW.  (The link on the bottom of that link provides more details.)  I would double check that the user is not failing via LDAP also.   With regard to groups, you can configure groups in the authentication profile under Advanced.  The groups configured under Device > User Identification > Group Mapping Settings > [edit group] > Group Include List will show in the authentication profile.  The firewall does an LDAP query for the group and gets the users.  If the login username matches, then the profile is used.   With regard to NPS, the Event Log > Security should tell you why it is failing.   Thanks,   Tom ... View more

Hi @birdperson ,   Yes, you can see encaps and decaps from Network > IPSec Tunnels > Tunnel Info next to your VPN.     You can also see them on the CLI with the command 'show vpn flow tunnel-id <tunnel-id> | match "p p"'.  This doc is an excellent VPN troubleshooting reference -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClivCAC.     Thanks,   Tom ... View more

Hi @Blake_Wofford ,   Here is a new process to install Expedition on Ubuntu -> https://live.paloaltonetworks.com/t5/expedition-articles/new-expedition-installation-procedure/ta-p/275276.  As the doc says, it will work for local hypervisors or cloud.   Thanks,   Tom ... View more

Hi @jennaqualls ,   Thanks for the info!  How do we sign up for the certification prep courses?   Tom ... View more

Hi @MarcelPeeters ,   The Feature Request ID is 11765.  You can see it on this list -> https://live.paloaltonetworks.com/t5/general-topics/feature-request-list/td-p/209128.  If everyone on this thread contacts their PANW SE and asks them to vote for 11765, the feature request should be given more priority.   Thanks,   Tom ... View more

Hi @FWPalolearner ,   The answer by @PavelK is excellent.  I would like to add a few pros and cons that I believe are accurate:   PAN-OS SD-WAN has more security features because of the NGFW. Prisma SD-WAN scales better because of the automated setup. Prisma SD-WAN is more complex. Prisma SD-WAN integrates with other vendors.  This page looks cool -> https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-integration/secure-sdwans-with-prisma-access.html. Prisma SD-WAN integrates with Prisma Access. Thanks,   Tom ... View more