Hi Team,   I import the configurations from managed device to panorama then export to managed devices of our A/P firewalls. everything went well. but when I see the summary on panorama passive device template   showing   as in   sync   but active device template disappear.    PFA below for your reference,       ... View more

Hi Team,   We tried to implement the OKTA SAML authentication method for GP in our organization.   Does Global Protect - "Prelogon Then On-Demand" connection method supports Okta SAML for authentication (MFA).?   If not what is a recommended GP connection method to use Okta SAML authentication.   Could you please help us here! I tried all resources I didn't got an answer..!!   _ Regards, Sethupathi M     ... View more

Hi Team,   I have configured Scheduled Configuration export to linux SFTP server, it doesn't work.   Hence I'm using default sftp port 22. But in configuration I could only saw the option that can export only using FTP or SCP.   I've tried using winSCP its working. But when I tried using cli command to export the "configuration.xml" file from panorama to SFTP server with port 22 it's not working.   In Panorama when tried using CLI command to export the "config.xml" file I found only FTP & TFTP not SFTP.    admin@BSDCPanorama-01(primary-active)> tftp export configuration remote-port 22 from Snap_18042020 to 172.21.32.4 mode set to octet Connected to 172.21.32.4 (172.21.32.4), port 22 putting /opt/pancfg/mgmt/saved-configs/Snap_18042020 to 172.21.32.4:Snap_18042020 [octet] Transfer timed out. admin@BSDCPanorama-01(primary-active)>   1. Does SFTP supports to export the configuration from panorama?    2. Can we export the configuration.xml file to SFTP server using SCP? If yes please clarify how to accept the host key. when tried test scp server connection getting below error:   Can any one please help us here! Didn't found any related articles about this query.   - Regards, Sethu     ... View more

Hi Team,   Wants to understand why ssl certficate is required in the gateway when tunnel mode is in IPSEC. Can anyone please provide the in depth connectivity process and justification for the need of SSL certificate on each gateway.    - Regards, Sethupathi M ... View more

Hi Team, Below is possible in paloalto side?   Note: there is no proxy in between client and paloalto   Problem description : The clients behind PA firewall connecting to AWS NLB then connecting to our AWS web servers(https:// tallysolutions.com).  Now we are not able to see the actual client ip address in the AWS Web server.  To resolve this issue AWS team suggested to insert XXF header in the client traffic. Can we achieve this in PA?   As per AWS : " The internal ALB appends the NLB’s private IP address in the X-Forwarded-For header before sending to a request to the backend targets. Therefore, if the requests from the clients contain X-Forwarded-For header, the backend targets will see the clients’ actual IP addresses along with the private IP address of the NLB in the X-Forwarded-For header. Otherwise, the backend targets will only see the NLB’s private IP address in the X-Forwarded-For header. "   Can anyone help me here?   - Regards, Sethupathi M ... View more

Hi,   We've configured BGP between Paloalto to Azure by using EBGP. The bgp is established but in RIB Out noticed that prefix 0.0.0.0/0 advertised to the peer respective azure.    How to remove this, because due to this the users in bgp unable to access the internet.   If I enable the "reject default route" option does this help? or cause any problem with all other bgp connections? can anyone help & give your valuable suggestion here.   - Regards, Sethupathi M ... View more

Hi Team,   I have configured GP using "On demand" method when I tried to disconnect GP by ran the command ( user@linuxhost:~$ globalprotect disconnect ) getting below error,   sweekrit@sweekrit-HP-240-G6-Notebook-PC:~$ globalprotect show --error Unable to establish a new GlobalProtect connection as a GlobalProtect connection is already established from this Linux system by the same user or another user. sweekrit@sweekrit-HP-240-G6-Notebook-PC:~$   Before connection method was "Always ON" I tried by changing "ON Demand" method but it didn't help.   below is the configuration snapshot.     When ever I tried to connect with different gateway I used to restart the machine.   Is there any way to disconnect GP on linux machine instead of rebooting the system?   I had verified all queries on community but there is no accepted solutions.   Can anyone help us here.   - Regards, Sethupathi M ... View more