About slp-security

Hi all,   I'm looking for a configuration guide to implement SAML authentication for Global Protect users using AWS ? Basically I want to do the same like this (Azure in this case)... https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PP33CAG   Which service do I need on AWS ? Cognito or IAM ?   Regards,   HA     ... View more

Hi all,   First, I 'm pretty with AWS... VPC is configured in the range 10.0.0.0/16. I have a firewall (PA VM) deployed with 3 interfaces (Untrust, DMZ, Trust). Untrust: 10.0.0.0/24, Internal : 10.0.1.0/24 (FW.1) , DMZ : 10.0.99.0/24 (FW.1). I created 3 Routing tables for each zone and assign each subnet into the RT. I changed the default route for routing table DMZ and Internal, pointing to the FW.   Because each routing table (focusing on DMZ and Trust here) has a default entry (10.0.0.0/16) pointing to local that cannot be changed, it's possible to pass traffic from DMZ to Internal WITHOUT traversing the firewall. I created two self referencing security group (SG-TRUST and SG-DMZ) and assign it to each ENI (FW ENI and host ENI). Now traffic is blocked (so bypassing fw is not possible anymore) but routes needs to be added on each host to pass traffic from Trust to DMZ (and reverse)   ON DMZ Host 10.0.1.0/24 gw 10.0.1.99.1 (FW)   ON Internal Host 10.0.99.0/24 gw 10.0.1.1 (FW)   Is it possible to avoid creating this static routes on the host and force traffic to traverse the firewall (configuration on the routing table) ?   Regards,   HA ... View more

Hi all,   Does anybody known how to integrate Palo Alto with Menlo Security Solution ? The goal is to transparently redirect HTTP/HTTPS traffic to Menlo appliance for specific URL Categories...   Any idea ??   Regards,   HA    ... View more

Hello,   We are running two clusters of PA820 in release 9.x. Both suffer from instability... Basically, all HA interfaces go down and a complete reboot (both nodes) is required to get it up again ! We can access the GUI but the firewall does not pass any traffic. The state of cluster is OK (one active and one passive). The MGMT interface is used as backup. We already tested release 9.0.2-h4 and 9.0.3. Any stable release for PA820 cluster ?   Regards,   HA ... View more

Hi all,   One of our customer move from Checkpoint to Palo Alto (single VSYS and two zones). The idea now is to split the network multiple zone and multiple VSYS (5). I would like to use the 'Auto zone Assign' features so Expedition will calculate the source zone and destination zone automatically. For the moment, if I move one interface from one zone to another zone and select 'Auto zone Assign', the rulebase remains unchanged...   Regards,   HA ... View more