About OwenFuller

Check to see which certificate profile is listed under Templates > Network > GlobalProtect > Gateways > your-gateway > Authentication > Server Authentication Find this profile under Templates > Device > Certificate Management > SSL/TLS Service Profile and take note of which certificate is used. Find this certificate under Templates > Device > Certificate Management > Certificates Check that CN of the subject matches the gateway address specified in the portal configuration under Templates > Network > GlobalProtect > Portals > your-portal > Agent > your-agent-config > External (or Internal) > External Gateways Check that today's date does not fall outside the Not Valid Before/After dates (also check that system time on the GP client machine is correct. If everything looks good, try exporting your logs from the GlobalProtect client, and looking at PanGPS.log for clues. ... View more

I agree with @rmfalconer on the route metric issue. That's why I'm thinking ECMP with the symmetrical return option might be your best bet. I've not tried this with multiple VRs in the setup you have described. You could try it though, and if necessary, move all three ISPs to the same VR. ... View more

You know, if you have different internal and external DNS zones for your domain, you might be able to use a generic block page with a link to different sets of instructions for internal and guest users. For example, "Visit webblocks.mycompany.com for details" might be the URL in the block message. Assuming your guest networks don't use your internal DNS servers, this could point to a public page which includes info about what content is blocked, the acceptable use policy, etc. On your internal DNS server, that record could point to an internal web server showing a page with instructions on how to contact support. This is definitely just a workaround, and only works if your DNS is setup as described, but I thought I might mention it anyway. ... View more

Assuming this diagram matches what you are trying to do, you'll want to apply a source NAT policy for the tunnel traffic on the remote firewall, so that their traffic appears to come from a network other than 192.168.1.0/24. If the servers on the local network don't need to know the individual client IP of the source traffic, a single address can be used for a many-to-1 source NAT policy policy. Otherwise, if the ability to discern individual source IPs is needed, several 1-to-1 source NATs will be needed (Palo Alto can do this as a pool). In this example I've used 192.168.2.1 (many-to-1) and 182.168.2.0/24 (1-to-1) for the Remote Site source NAT addressing. On the Local Firewall, you'll want to use a 1-to-1 destination NAT policy where the pool of 192.168.5.0/24 addresses translate to 192.168.1.0/24. You can find the details on how to configure these policies here: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/nat.html   ... View more

The easiest option might be to use NAT policies on your tunnel. A dynamic IP pool would let you dest NAT 192.168.5.0/24 to 192.168.1.0/24. However, if the source subnet on the remote side is in conflict, a src NAT policy might need applied on that end as well. ... View more

The only way I'm seeing to do this would be if your guest network was in another vsys. There doesn't seem to be any options for making these pages zone-specific. ... View more

Have you considered using ECMP instead of PBF? If you weighted your default routes to your three ISPs equally, and used ECMP with the symmetric return option enabled, it might do what you're wanting. ... View more

I think I'm visualizing your setup, but it's a bit complicated to work out in text. Can you provide a network diagram which shows your networks, VLANs, and zones just to be sure? ... View more

I participated in the 5.2 beta, and did some testing with a few users, but we didn't deploy it into production. I created simple batch file and registry file, so my test users could install it easily. You could see if the settings work for you, and probably configure something similar in SCCM or your software installation tool if you want. Batch File wmic product where name="GlobalProtect" call uninstall /nointeractive msiexec.exe /i GlobalProtect64-5.2.0.msi /quiet PORTAL="portal1.yourcompany.com" CANCONTINUEIFPORTALCERTINVALID="no" CANCHANGEPORAL="no" "C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe" -registerplap reg import PaloCBL.reg  Registry File (PaloCBL.reg) Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\CBL] "Portal1"="portal1.yourcompany.com" "Portal2"="portal2.somecompany.com" "AlwaysShowPortal"="yes" ... View more

Does the "forbidden" message look like a typical web browser error message, or a Palo Alto block message? Have you checked your logs for any blocks? ... View more

I'm not sure if this applies in your case, but I saw something similar when a user had two client certificates which matched the certificate profile. We solved it by deleting one of the unneeded certificates. ... View more

You might want to look at a product like TeamViewer for your purposes, which can allow you to access your home computer from your phone or another computer without needing to open up ports on your firewall. While it's not a Palo Alto solution, I think it fits your use case better. ... View more

Yes, the same for me. I just click on the link in the left-hand side bar though, and it takes me right to the details:  GlobalProtect App 5.2 Release Information ... View more

I remember running into this a few years ago, but I don't remember exactly what caused it. The issue with the web portal might be due to the web browser looking only in the user certificate store. You could try putting the client cert you put in the machine store in the user store as well. As to why the cert profile is not enforced on the connection from the GP agent, I'm not sure what to suggest here other than to make sure you actually committed the changes on firewall, or committed/pushed from Panorama. ... View more