About BTS_MS

Hi all, I am trying to enable Global Protect. So far I've been able to connect the client to the firewall successfully. However the remote VPN client cannot talk to inside hosts. But the inside hosts can ping the remote client. After troubleshooting, I found  IPSec traffic is blocked at the outside interface (which blocks everything). When I enable all incoming traffic on the outside interface the remote client is able to talk to the inside zone. I've now enabled "IPSec" application group to be passed through the outside interface, however the remote client is still unable to talk to the inside zone. Is there a standard set of applications/services that needs to be allowed on the outside interface for GlobalProtect clients? Many thanks. ... View more

Hi All, My dashboard shows a "App Version Mismatch" in a HA setup. The active is supposed to download the app version and sync it to the passive. To confound the issue as per the following the "active" firewall is running the older version causing the mismatch: admin@(active)> show high-availability all | match Application       Application Content: 327-1497       Application Content Compatibility: Mismatch       Application Content: 328-1503 However the following shows active is running the latest version: admin@(active)> show system info | match app-version app-version: 328-1503 So HA is saying the active firewall is running a older app version than it actually is. Any hints on how to go about correcting this situation? Many thanks! ... View more

Hi All, I'm attempting to install a wildcard certificate on the firewall for Global Protect and Captive Portal without much luck. Basically I'm trying to use the existing wildcard certificate, the organization has. Steps I've taken: 1) Export the certificate and the private key as *.pfx out of IIS. 2) Convert these to PEM files with openssl. 3) Download the intermediate certificate from the vendor website and paste it at the bottom of the certificate. 4) Upload the cert and the private key as pems. The error I get from firefox is "sec_error_unknown_issuer" . It does work on safari. So it looks like the intermediate certificate is not recognized? Is there something that I am missing with the steps above? Or is there a better way to do it? Many thanks! ... View more

Hi, Our PAN 2020 is setup for URL filtering. After a reboot  we're now getting excessive matches for the "unknown" category. It appears URLs are not looked up on "Dynamic DB" and "Cloud DB". Ex: (active)> test url www.nds.org.au www.nds.org.au society (Dynamic db) (active)> test url-resolve-path www.nds.org.au URL www.nds.org.au, category unknown As per instructions from previous threads I've tried to remove www.nds.org.au from the URL cache: (active)> clear url-cache url www.nds.org.au This command requires the Palo Alto Networks URL filtering database. What does the "This command requires the Palo Alto Networks URL filtering database." mean?  We are running URL DB version 3933 and FW says it is the latest update. Many thanks for any direction on resolving this issue. ... View more

Any ideas why if a user browses to www.pokerstars.com or www.playboy.com, they get this; So they are being categorized as ‘google analytics’ and allowed? Yes, these 2 URL’s are classified as Gambling and Porn on Brightcloud respectively. Any ideas? ... View more