About OwenFuller

Thanks for the suggestion. Unfortunately, the guidance at /api doesn't get that granular for commit-all.   It turns out that the answer was to add a </entry> tag after the serial number entry as shown:   <entry name="<serial_number>"></entry>    Then, to get it to run properly in Powershell, add backticks to escape quotation marks around the DG name and serial number. ... View more

Sorry, I deleted my last comment, as I thought you were trying to turn a ZTP firewall into a non-ZTP firewall. As I understand it, there is a separate physical chip (or chips) on the ZTP firewalls that is not present on non-ZTP models. ZTP models also have a claim code listed on them, which is needed to activate them w/ the ZTP service. The ZTP service at Palo Alto is expecting to match the serial/cliam key w/ a hash in a database when it connects. There isn't a way to make a non-ZTP device use ZTP. ... View more

Check to see which certificate profile is listed under Templates > Network > GlobalProtect > Gateways > your-gateway > Authentication > Server Authentication Find this profile under Templates > Device > Certificate Management > SSL/TLS Service Profile and take note of which certificate is used. Find this certificate under Templates > Device > Certificate Management > Certificates Check that CN of the subject matches the gateway address specified in the portal configuration under Templates > Network > GlobalProtect > Portals > your-portal > Agent > your-agent-config > External (or Internal) > External Gateways Check that today's date does not fall outside the Not Valid Before/After dates (also check that system time on the GP client machine is correct. If everything looks good, try exporting your logs from the GlobalProtect client, and looking at PanGPS.log for clues. ... View more

I agree with @rmfalconer on the route metric issue. That's why I'm thinking ECMP with the symmetrical return option might be your best bet. I've not tried this with multiple VRs in the setup you have described. You could try it though, and if necessary, move all three ISPs to the same VR. ... View more

You know, if you have different internal and external DNS zones for your domain, you might be able to use a generic block page with a link to different sets of instructions for internal and guest users. For example, "Visit webblocks.mycompany.com for details" might be the URL in the block message. Assuming your guest networks don't use your internal DNS servers, this could point to a public page which includes info about what content is blocked, the acceptable use policy, etc. On your internal DNS server, that record could point to an internal web server showing a page with instructions on how to contact support. This is definitely just a workaround, and only works if your DNS is setup as described, but I thought I might mention it anyway. ... View more

Assuming this diagram matches what you are trying to do, you'll want to apply a source NAT policy for the tunnel traffic on the remote firewall, so that their traffic appears to come from a network other than 192.168.1.0/24. If the servers on the local network don't need to know the individual client IP of the source traffic, a single address can be used for a many-to-1 source NAT policy policy. Otherwise, if the ability to discern individual source IPs is needed, several 1-to-1 source NATs will be needed (Palo Alto can do this as a pool). In this example I've used 192.168.2.1 (many-to-1) and 182.168.2.0/24 (1-to-1) for the Remote Site source NAT addressing. On the Local Firewall, you'll want to use a 1-to-1 destination NAT policy where the pool of 192.168.5.0/24 addresses translate to 192.168.1.0/24. You can find the details on how to configure these policies here: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/nat.html   ... View more

The easiest option might be to use NAT policies on your tunnel. A dynamic IP pool would let you dest NAT 192.168.5.0/24 to 192.168.1.0/24. However, if the source subnet on the remote side is in conflict, a src NAT policy might need applied on that end as well. ... View more

The only way I'm seeing to do this would be if your guest network was in another vsys. There doesn't seem to be any options for making these pages zone-specific. ... View more

Have you considered using ECMP instead of PBF? If you weighted your default routes to your three ISPs equally, and used ECMP with the symmetric return option enabled, it might do what you're wanting. ... View more

I think I'm visualizing your setup, but it's a bit complicated to work out in text. Can you provide a network diagram which shows your networks, VLANs, and zones just to be sure? ... View more