About rlambright

it's not my call, the higher ups want a switch before each firewall. so HA1 has to go through these lagged switches so that if a switch goes bad it will failover. ... View more

Hello, If you have a quick drawing, that could help us answer your questions.   Regards, ... View more

@rlambright, at my specific case it was noted as a bug and fix was provided. General issue was with mixing UPN and SAM type of usernames in the policies. PAN-153614, fixed in 9.1.8 & 10.0.5. "Fixed an issue where user-based policies did not correctly match if the same user was included in both a policy with the username in NetBIOS format and another policy with the username in FQDN format."   If you are running any of these versions or above - it should be a different case there.   Workaround from my case (use it at your own risk, given we don't know if it is the same issue): "> Remove User Domain override configuration from the Group-Mapping configuration. > Configure one specific user-attribute in all the security policies" ... View more

Thoughput (app-id, threat, ipsec) Decryption specs (concurrent decrypted sessions, certificate cache, inbound certificates) 10Gbit SFP+ ports Route table size Forwarding table size ARP table size NAT rule capacity (static, DIP, DIPP) Supported subinterface count for QoS IPSec VPN tunnel count IKE peer count Global protect connections (clientless and standard client VPN) --> https://www.paloaltonetworks.com/products/product-comparison?chosen=pa-3220,pa-3250 ... View more