About googol

yep, just noticed your logs and reviewed. you do indeed have flush dns enabled.   also be prepared to have to uninstall the GlobalProtect client and reinstall it, to clear out that bad setting. that was unfortunately my fix for the issue, because even though if it was disabled, it somehow was still cached and continued to do it until I uninstalled it and reinstalled.   Hopefully thats better in v3.0.2 and 7.1.x code. When I was going with this problem, I was on v2.3.x GP and 7.0.x ... View more

this is getting real annoying, so many alerts due to this. is this something PAN can fix for us or we have to wait on Akamai ... View more

google Chrome updates should be classified as "google-update" if I remember correctly. ... View more

Just how it is, I have seen a similar setup from other vendors as well, not just firewalls, but software too. sometimes just gotta do the major releases, then get to where you are going.   I don't see 7.1.2 released? 7.1.0 was recently released, no 7.1.1 yet but probably soon. ... View more

definitely have to agree, we have portals with different configurations and would be nice to have just one portal, which would give them all the configuration they need and control their experience as necessary. ... View more

good find, looks like they missed their own statements "intuitive for users"   a fresh clean interface that is very simplistic to use would go a long way. ... View more

don't even install 7.1 on your panorama unless you want your configuration wiped by panorama templates when committing...   yay for bugs ... View more

Excellent points and I agree the UI comes into play more with an on-demand scenario.   In an Always On mode, the user interface comes into play during troubleshooting (or they simply want to see the status), when the user wants to have some control over it, or to like speed it up.   In an always on setup, I agree that they should not have to open the client much, but the gateway authentication process prompts them for their username and password on first connection (if not already placed into the client UI), but other times SSO works as it should. They also go into the client UI to update such password every time their password changes (depending on policy and requirements of various businesses). Other VPN Clients do not ask for username/password, is SSO and seamless. Ultimately this would be the most ideal as credentials are not stored.   It sounds like you are gearing towards having the main processes accessible via the GP submenu from the taskbar (to avoid opening up the main UI). This is fine and most folks can do that as well. Disable is there for those that need to "disconnect" from Always on for whatever reason. All it takes is double clicking the GP icon and the UI home is open or misclicking on Show panel, and the UI is shown.   Why are you limiting the "Status" button of the 3.x client? Having it be whatever size, as previously mentioned by others, does not make sense for some of these screens such as the "status page". It is a lot of deadspace. I rather instruct my users to go to show panel (or simply doubleclick the GP icon) because it gives them access to more data that they need, such as how they are connected, IP addresses. etc or troubleshooting. I get that you are keeping it resizable/large for essentially the details and troubleshooting tabs.   Menu Status Show Panel (shows status as well)   In the end, the user is going to open the panel at some point or two and perception is key. Especially to acceptance of the product. ... View more

I'll be upgrading my panorama to 7.1, but holding off on the firewalls until later, like 7.1.2 unless I need the feature sooner. ... View more

Better release notes here:   https://www.paloaltonetworks.com/documentation/30/globalprotect-agent-rns   Other features are tied to PAN OS 7.1 - https://www.paloaltonetworks.com/documentation/71/globalprotect ... View more

Only way I can see you doing that is if you deploy their PAN FW VM on AWS or Azure, get URL Filtering and have your Gateway be that VM, instead of back home in HQ.   Their whole idea around GlobalProtect and I have to agree, is leveraging the features of the PAN firewall like the threat prevention suite, but you can certainly do that in a VM out in the cloud.   It is not just the UI, that is just one thing in a list of things that can be improved.   another issue is the upgrading process or lack of allowing us to do inplace upgrades so we can deploy using other deployment methods like SystemCenter. The upgrade process has left users stranded without GlobalProtect installed since the 2nd phase never completed.   Another is performance related. GP IPSEC gets to about the same speeds as SSL VPN with anyconnect, which should not be happening. If I run SSLVPN on GP, its horribly slower. Definitely would like to see it improved/optimized, I should be able to push a decent amount of traffic when you have the bandwidth on both ends of the connection.   I don't want to take away from the sole purpose of this thread, which is the cosmetic/UI. ... View more

thats my point. But yes, I agree with moving off the ASA. Thats what our idea was with PAN as well. Collpase things down, dont have to refresh ASA, smartnet, etc. ... View more

what advantage does GP have over anyconnect? GP is still playing catchup to AnyConnect. ... View more

I wholeheartedly agree with this. I have brought it up with multiple people at ignite this year and previously with product managers.   The programming you refer to is a few minutes in visual studio for the UI, but can be cosmetically improved 1000 fold. I understand they were going for function, but we are in a world where the user experience matters. If the user experience is not great, they won't accept and use the product.   They made a change so that they can provide updates to GlobalProtect without having to wait for OS updates, which is great and needed for the development of the product, so hopefully they will utilize that and we see improvements via that route. ... View more