About pulukas

you have the option to save configurations at any time during the candidate process.  The revert to last saved is used to go back to a fallback point that is in between the current running configuration and your current candidate configuration. None of these operations, revert to running or revert to save affect traffic at all. ... View more

Unfortunately, you cannot use browser proxy settings to direct internet traffic to the PA as you do with the ISA proxy server.  I'm sorry my previous attempts to explain the difference are unclear. The PA web filtering relies on traffic routing to deliver the web browsing traffic to the PA firewall and then from the firewall on to the internet.  The inspection takes place by rules applied then to this traffic. With a remote site that has their own internet access, you  need to configure a separated routing domain for the user traffic that has a default route into the vpn tunnel up to your PA site.  This is the only way the internet traffic can then come through the PA before browsing. You will need to change the routing architecture of the remote site to get the traffic up to the Palo Alto for web browsing. Naturally, you could replace the ASA  with a PA200 instead and do the inspection locally. ... View more

If budget is the problem there is a basic open source load balancer in the Zen project on source forge. Zen Load Balancer | SourceForge.net ... View more

You can probably do a packet capture and modify this procedure that blocks Chrome to be unique for Dodge Chrome. How to Block Google Chrome ... View more

But PanLst is choosing "Block" not "Default" for the action. The help file does not specify which action occurs with "Block" drop or reset.  Are you saying above that the action is reset both?  ... View more

The PA can definitely replace the filtering functions on the ISA. Your configuration issue is just with the routing domain.  From your description, right now you have local internet routing at the ASA site but via the proxy server web browser settings the actual internet path is the ISA server at your PA location.  This method is not applicable to the PA web filtering. You need to change the routing setup on the ASA so that the default route for internet traffic on the user subnet takes the vpn tunnel. ... View more

The PA is not a proxy, so for it to filter the users you have to have it cross the PA for the internet access. I assume your ASA connects via a vpn site-to-site tunnel.  If this is true you can setup the remote site as a non-split tunnel and send all traffic to the core site with the Palo Alto and they get their internet access from here. To do this you create a separate routing domain on the ASA with your local LAN users and connect this to the vpn.  The default route for this domain is the vpn tunnel.  So all traffic from the users comes to the core. The main routing domain has the vpn gateway interface and connects the actual tunnel endpoints only. On Cisco routers these are called VRF, but I'm pretty sure they have a different name on the ASA. ... View more

Thanks for the note. I guess this make sense since you would need a route to use the DNS server.  So we would be adding a subnet for this route for the clients during the setup process. But I'm with you, I like to have independent control of where the routes are installed on the network. ... View more

Sorry but there is no user available mechanism to do this on the Palo Alto. You could look into scripting solutions as an option. But if you need to restart the management service frequently, you should probably open a case and get to the root cause.  This should only need to be done occasionally and not be a routine affair. ... View more

This pre-logon certificate is about having a specific client computer based certificate installed not the CA based certificate you have for your global connect portal. In this scenario you have your internal CA in Active Directory issue computer certificates to your domain computers (which can be done automatically via GPO). Then you install the CA certificate on the PA so it can recognize and authenticate those certificates.  Now you know at login that the computer connecting is a trusted domain asset. If a domain computer is stolen you then revoke that computers certificate in your Active Directory CA and they can no longer connect. ... View more

Palo Alto calls the IP SLA feature "Path Monitoring".  This can be used with a variety of features like virtual routers, Policy Based Routing, VPN or High Availability to control failover scenarios. Here are two sample configurations. Dual ISP Branch Office Configuration How to Configure Dual VPNs with Dual ISPs from a Single PAN to a Remote Site ... View more