What is the advantage of using the HSCI port for HA2 as opposed to using one or two data ports? Would a QSFP-40G-CR4 be compatible with the HSCI port?  Or a SFP-H10GB-AOC5M? SFP-1000BAS?   ... View more

I finally got certificate based always on GP VPN working when my laptop is at home.  It occurred to me that when people go into the office, they'd be on the internal LAN. How is that normally handled? Since I currently have an egress separate from the  GP PAN the traffic would hit the same portal as when they're home and noone would be the wiser. But it would be wasting some firewall circuits and adding some extra hops. Not a huge deal.    How is this typically handled? We have a separate DNS zone internal from external as most places do.   Thank you. ... View more

I now have GP connected automatically with a certificate pushed out via InTune. This is on a Surface Laptop running Win 10. I typically log in with face recognition. After I log on and notice that I have TCP/IP access through the GP connection and internal DNS is working - I am trying to then go to a file share. \\whatever\sys$\whichever say. I am then prompted for my credentials and a note is there "The system cannont contact a domain controller to service the authentication request." I have no thought why it can't find the DC. To work around this click "Use a different account" and enter my work email and password.This is the same email as the one associated with my face recognition. But after I login through using this "Other User" I then have access to the file share. I checked cmd/set user and that looks the same before my "Other User" login as after. Any ideas appreciated! ... View more

I'm excited to finally have pre-login working per the logs below. But after the successful certificate based pre-login,  portal-getconfig fails. On the pan the error message is "Failed to get client configuration". Any advise on how to troubleshoot this further is appreciated!     ... View more

Cisco is able to look at and correlate PAN events as well as other vendors. Does PAN have a dashboard  that looks at threats from multiple vendors/sources? ... View more

I am trying  to setup prelogon and have a question about the sec policies described in Step 2 of this guide: https://docs.paloaltonetworks.com/globalprotect/9-0/globalprotect-admin/globalprotect-quick-configs/remote-access-vpn-with-pre-logon.html    I assume the source zone would be VPN (applied to tunnel) and the destination zone is Trusted (internal) - correct?   Then for permitted applications I added AD, DHCP, DNS and ms-update. The right column notes dependencies. But I believe that when you add the application that those dependencies are automatically added - correct? I don't need to add those manually. Does this look like all I'd need for the prelogon security policy?     ... View more

We have an old vertical application that can connect to a web server via https and that populates the data in the desktop application (thick client). Mgt Team would like there to be two factor authentication. But if the thick app does not support two factor I think that's a non-starter. Or could there be some way that a legacy app not designed for two factor could still somehow leverage the firewall to require a second factor auth? ... View more