About JoergSchuetter

JoergSchuetter · ‎05-19-2020

Replace the plus signs with spaces. The name is already embraced by quotes.

JoergSchuetter · ‎05-12-2020

Hello @ScottHammond What happens if you add the zones one by one (instead of all at once)? If I remember it right, there are several ways to call the API. Are you using a "simple" POST or are you different various http methods?

JoergSchuetter · ‎05-01-2020

Hello @Stevenjwilliams83 Can you verify the issue is caused by the decryption with browsing the URL https://pypi.org/ in your browser and check the certificate. It could also be, that the firewall does not grant the access, and presents an error page (which is signed with your own certificate, hence the ssl error).

JoergSchuetter · ‎04-23-2020

Hello @rgrant2020 Do you have by chance configured a filter on Device --> Setup --> Interfaces --> Management --> Permitted IP Addresses? If you, you need to add the IPs of your management interfaces as well.

JoergSchuetter · ‎04-22-2020

Hello @twilson63 Yes, you can add/append more NICs to the firewall nodes. The virtual machine "hardware" where the firewall runs on defines the max. number of NICs. The first NIC is used for management, the others can be used for data or HA.

JoergSchuetter · ‎04-17-2020

Hello @Andrew.Vernon If you permit the access on the firewall security policy, then it's possible to facilitate a connection between two GP clients. Check your firewall logs for blocked traffic.

JoergSchuetter · ‎04-14-2020

looks like the issue is addressed with PAN-126014 (which is solved in 9.0.7, but I couldn't spot this fix for 8.1.x) Fixed an issue for GlobalProtect gateways where the Login At and Logout At time fields in the Previous User PDF/CSV report for User Information used the Epoch standard for displaying time.

JoergSchuetter · ‎04-13-2020

You can add multiple nodes to the same device group. How about a device group hierarchy? You define a device group (e.g. name it "common policy") and define the NAT and security policies here. For each firewall node/cluster, you create a new device group, add the firewall node (all nodes of the same cluster) to it and make it a child object of "common policy". This way you make sure the requirements concerning security policy and NAT are fulfilled. But you are still able to add exceptions or further rules if the need arises.

JoergSchuetter · ‎04-09-2020

The fee for 2 HA licenses is typically lower than 2 non-HA licenses (at least if you have an active/passive cluster, not sure if this also counts for an active/active cluster). The ",,,-R" is a license renewal.

JoergSchuetter · ‎04-07-2020

Hello @ALLADASAINITIN I configured my setup before I stumbled over the howto. Trying to verify if I did it correct, I read the howto. The question is: which path is a reply from the gateway IP (ISP 2) taking when sending a reply to the users PC (sent by GlobalProtect) on the Internet? My concern is the "tunnel" traffic between client and VPN gateway.

JoergSchuetter · ‎04-06-2020

Hello @SahulH Using QoS is a way to solve what you need. Please keep in mind that QoS can't be applied on loopback interfaces and that it only works on egress traffic.

JoergSchuetter · ‎04-02-2020

Hello I have read "How to Configure Dual ISP Network with GlobalProtect VPN using a Virtual Router and Policy-Based Forwarding" (https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClJeCAK) since we had exactly the same challenge a few days ago. I solved it using a second virtual router. If I follow the setup as shown in the HowTo, which ISP is chosen for an reply packet coming in via ISP2? The users PC (to be more precise the GP software) is connecting to the firewalls IP of ISP2, traffic coming in via line of ISP2. Due to having only one default route, I expect that the reply to the PC is sent back via ISP1.

JoergSchuetter · ‎04-02-2020

Hello @MohammedAsik Are you using cookies (see authentication override)? Do you have "Save User Credentials" enabled on the portal config (authentication)? Is "Clear Single-Sign-On Credentials on Logout" disabled on portal config (app)?

JoergSchuetter · ‎04-01-2020

Did you try "set cli scripting-mode on" ?

JoergSchuetter · ‎03-31-2020

The IP address should defined as a static IP in Azure. You can add multiple secondary IPs (static) as well. All of them can have a public IP. On the firewall, configure the IPs as static. The primary IP should have the matching netmask (e.g. /24), but the secondary IPs should be listed with /32. Now

Member Since	‎02-18-2018 07:04 AM
Date Last Visited	‎04-16-2024 12:24 PM
Posts	147
Total Likes Received	48

Online Status	Offline
Date Last Visited	‎04-16-2024 12:24 PM

About JoergSchuetter

Re: Having problems with TCP port allowance

Re: Security rule says disabled no for an enabled policy

Re: GobalProtect setup accross multiple standalone FWs in Azure

Re: Azure SAML double windows to select account

Re: Is there entry limit when resolving FQDN?

Re: datapalne issue

Re: IPSEC VPN - app-id

Re: CLI: Disable Panorama Policy and Objects

Re: Change Name of active Zones or Replace

Re: Split tunnel but I see that packets from Teams calls are being sent over the VPN connection

Re: Security rule says disabled no for an enabled policy

Re: Excluding MS Teams from GlobalProtect

Re: datapalne issue

Re: IPSEC VPN - app-id

Re: Split tunnel but I see that packets from Teams calls are being sent over the VPN connection

User-ID stopped working / Failed to add group to id manager

Re: Globalprotect 5.2.5 popup message

Re: GlobalProtect Client OS Support

Overriding existing User-ID mappings with Captive Portal to elevate privileges

Re: aggregated-ethernet - combine SFP+ and Cu port possible

Re: Using x-path with spaces

Re: Adding Zones/Tags with XML API

Re: SSL decryption issue with PIP

Re: HA1 Backup Down - PA220 9.0.4

Re: Adding 4th NIC to Palo Alto VM in Azure

Re: GP communication between remote users

Re: Global protect External gateway in remote user time format issue

Re: Panorama Integration with Firewalls

Re: Differnece between Threat Prevention Licenses

Re: multiple ISPs for GlobalProtect

Re: Is there any way to Priroritise some application traffic for GP Users

multiple ISPs for GlobalProtect

Re: GP login without asking credentials

Re: cli scripting mode without strict check

Re: Second Public IP for VM-300 hosted in Azure

Unlock your full community experience!

About JoergSchuetter