About Abdul-Fattah

thats right. the Firewall needs group mapping so you can use AD groups on your firewall. ... View more

for example in a Security policy, to be able to control traffic of a certain user you will need IPs to User mapping. And if you want to control traffic of a certain group you will need IPs to User mapping & users to group mapping.   ... View more

Hi @Sarou22 , - the firewall provide several methods to map IPs to user, one of them is server Monitoring which allow the firewall to monitor AD servers for users authentication, so the firewall can do that among other methods as well. for more info check this out: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/user-id/map-ip-addresses-to-users.html#id61f141da-8b89-49c9-b34a-ed11b434d1db - About group to user mapping also the firewall itself will do that, when it is configured, under Device>User Idenetification. ... View more

@Vijaygvasan, resarting the user-id process should solve this, but be aware that all info about the user will disapper and repopulated again. you can try to refresh the group-mapping: refresh: debug user-id refresh group-mapping reset:  debug user-id reset group-mapping if it does not work, also you ca try to refresh the user-ip-mapping agent: for certain IP: debug user-id refresh user-id ip (ip) agent (Agent-name) for certain agent, : debug user-id refresh user-id (Agent-name). for all agents : debug user-id refresh user-id all. for more info check this out: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVtCAK   ... View more

make sure your self-signed comply with this also: https://support.apple.com/en-us/HT211025 you can make the self-signed root CA trusted under your IOS device settings: Settings > General > About > Certificate Trust Settings then enable full trust for that CA. ... View more

i would like to suggest that you look for the solution on IOS websites also,  this could be a good start point: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HB5rCAG https://support.apple.com/en-us/HT204477 ... View more

check the User-IP mapping to see if it is againg-out correctly, if not check your User-ID Sources and change the time-out accordingly if needed.  ... View more

Hi @preetpk , you can use both profiles in an Authentication Sequence profile, then use this Sequence profile for  GP authentication.   ... View more

under Settings>General>About> Certificate Trust settings.  ... View more

@Vijaygvasan you will need to activat this also ... View more

@prabhakaran.s make sure that the certificate is fully trusted on IOS devices, under General>About> Certificate Trust settings. ... View more

@Vijaygvasan make sure also that the certificate is fully trusted on IOS devices, under General>About> Certificate Trust settings. ... View more

Hi @Alleria , to be able to ping any Interface that belong to the firewall, each interface will need to have an "interface Mgmt with ping checked" assigned to that interface, you can find and create Interface mgmt under Network > Network profiles > interface Mgmt. and after that assigning it on the interfaces from Interface Advanced tab. on the other hand you should be able to ping other hosts from firewall, but for your information if you did not specify the source of ping, the firewall will use the Physical managment interface, so i would try "ping source x.x.x.x host x.x.x.y" where xxxx the firewall interface that belong to same host-network. hope that will work.     ... View more