About ydhanuka

Yeah, the 6.0.1 has the fix for emergency use and 5.2.12 with the fix is expected sometime in May. Exact ETA will likely be not available since this will be subject to lots of QA processes before it is ready for release.   ... View more

Hi Kevin, If there are crashes for the process than that needs to be isolated to identify what is causing those. You can may be ask for more details from TAC on why the process is crashing and also involve local IT team or microsoft as applicable to identify what process is causing the crash. Another good way to isolate is to take a test machine and remove all other 3rd party softwares from there except GP and check if the issue persists.   ... View more

Hi Eddie, Which vulnerability you are looking to get a fix for ? the link below shows the known vulnerabilities and affected /unaffected version if you haven't check it already.   https://security.paloaltonetworks.com/?product=GlobalProtect+App&sort=-date ... View more

Hello Kevin, I would suggest to open a TAC case to check the PanGPS logs on the global protect to see why the connection fails. Even when the windows needs to connect to these URL's, it should not stop GP from connecting. Unless for some reason, the OS or any other app is blocking the PanGPS process from connecting in first place. ... View more

Hi @Mohammed_Yasin    A zone protection profile should help alleviate the problem. For the mgmt IP, a change in network may be needed where it is connected to a switch and then the traffic is routed through one of the data interfaces where the zone protection profile is enabled with relevant TCP options enabled. https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/threat-prevention/best-practices-for-securing-your-network-from-layer-4-and-layer-7-evasions.html   Hope this helps Yogesh ... View more

Hi @greg.donohoe    You may want to upgrade your panorama to 10.0.5 if not done already.  Check the release notes here and search for "PAN-152813" https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-release-notes/pan-os-10-0-addressed-issues/pan-os-10-0-5-addressed-issues.html#panos-addressed-issues-10.0.5   If that does not fix the issue, then I would suggest to open a support case with the tech support from panorama attached.   Hope this helps, Yogesh  ... View more

Hi @RohanArya61    There are few things you can do to isolate the issue.  1: Check the Global protect firewall logs for the logs with respect to the website you are trying to access to make sure it not blocked. 2: Perform packet capture on the firewall for source IP and destination as the site IP if no block logs on firewall.  3: It is possible your public IP on firewall might just be blocked on the server. 4: If using SSL decryption on the firewall, add a rule to bypass SSL decryption for this site and check if that works.    Hope this helps, Yogesh  ... View more

Hi @kellysalinas1    This should be possible to do without LDAP and directory sync is going to pull the users/groups mapping bases on what groups are configured in the security policy. For the IP-user mapping, however, you might need a user ID agent since it is remote network and there is no GP.   Hope this helps, Yogesn ... View more

Hi @nwnetadmin ,   I believe you may be missing predefined EDL based on the screenshot. This article below should help.   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PM0pCAG   Essentially, dynamic updates with AV needs to be downloaded/installed for all the predefined EDL's to be present on the firewall and use it further.   Hope this helps, Yogesh    ... View more

Hi Mike,    You can consider using remote networks for the internet access for users in a site.  https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prisma-access-for-networks/plan-prisma-access-for-networks.html The other requirement to make the site available on internet can also be done with inbound access and here is the document for that. https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prisma-access-for-networks/quick-configs-for-network-deployments/provide-secure-inbound-access-to-remote-network-locations   Hope this helps, Yogesh  ... View more

Hi There,   Yes, you can log the blocked URL sessions on firewall or panorama. Just enable the logging in the action Tab. I would suggest to go through this short demo which will help answer related questions. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClmgCAC   Thanks, Yogesh ... View more