About MichaelMedwid

Is there a means of copying all configuration from a 3220 PAN to a 3250 including the certificates?  The main impetus to upgrade would be to accommodate more Global Protect tunnels (2048 instead of 1024.) I'm trying to understand what that migration might look like. TY ... View more

Each individual  3220 is licensed for 1024 GP sessions I believe. So if you have a pair in active-active HA does that mean you could have 2048 sessions?  ... View more

How can you view the peak number of global protect licenses are being consumed on a PAN? And when those licenses are consumed, what is the behavior of the GP clients that connect beyond the limit? For example the 3220 allows for 1024 GP connections simultaneously from what I understand. What happens to the 1025th GP client that attempts to connect? TY ... View more

For the screen cap below I filtered the destination IP to one particular server.  This Source IP Network Activity widget is showing me the first 10 IPs that talked to it. But then all the other sessions are summarized as "others".  I want to know all the IPs and to then export that information. Clicking on "others" doesn't seem to do the trick. If I click the down arrow at the right side of others I get four ghosted options. What's the mojo?     ... View more

In logging I can see that  SAML authentication via Azure is succeeding. However my GP client is failing to successfully connect I believe for some deficiency in the certificate. I have a self signed certificate in a cert profile at the portal and gateway for this GP On Demand setup. Authentication is set to require certificate *and* user ID/password. (Soon this will be MFA. But first things first.)    Can a self signed certificate serve the need in this case? What properties would need to be in such a self signed certificate to get GP connect? Thank you.   ... View more

I have some GP users who like to complain about their GP connection but with whom are  difficult to book troubleshooting time. Could there be any way to remotely collect details of their GP session without having to tell them how to initiate a log capture or remoting into their machine? Perhaps something could be pushed to their laptop via  Azure Autopilot? Any thought appreciated. ... View more

I have a portal/gateway working with Active Directory. Now I'd like to limit access to only members of a certain  AD group. What is the best way to enforce that? Thank you. ... View more

Is a special license required for performing HIP checks on clients trying to connect with Global Protect to the PAN? I see the PAN has Premium, Threat Protection, Wildfire and PAN DB URL presently.  ... View more

When setting up a portal or gateway there is a place to configure authentication - say with LDAP or other.  What is the relationship between the portal and gateway from the perspective of authentication?  Obviously you'd want users to just log in once. ... View more

I am trying to troubleshoot a user who is claiming they are getting disconnected from GP VPN due to issues seen at the application tier. I show them logged on since just before 7 and traffic logs appear to show continuous TCP traffic in the last five hours since log on. But I was thinking I'd put on a recursive ping to her laptop. But that traffic is dying at the PAN and I'm not seeing the ping that's getting denied if I look at Monitor/Traffic. Traceroute shows allowed but it's not reaching the GP client IP. Is there anything I can do to verify they are continuously connected?   UPDATE: I think the lack of ping-through may be on the side of the laptop. BUT I can see in GP  logs that a latency figure is measured on a regular interval. Is there a means to get more details like the latency on a specific session?       ... View more