About SutareMayur

Hi @DJ_Palo ,   What do you mean by Internal ISP? Do you mean Local internet?   Additionally I would ask you to do few things given below -  1. Try to do traceroute to any public IP and verify path 2. Check if public URLs are resolving IP addresses when connected to VPN 3. Check if any proxy is being configured automatically under browser post connecting to VPN. ... View more

Hi @GaurangSharma ,   Check this recent post from  Palo Alto Networks Education Services.    Palo Alto Networks Education Services on LinkedIn: Education  Hope it helps!  ... View more

Hi @PChow4 ,   You can verify the detailed log view of desired URL category matching traffic vs rest then you will get clarity. But again, answer to your question in one short line - the unwanted traffic matching your rule are for TCP/SSL session created with the destination. At the end, traffic will be allowed based on the matched URL.   Ref. article   Hope it helps! ... View more

Hi @PChow4 ,   Yes, with the type of policy you have written, you will see that it is showing allowed traffic logs for rest traffic also. But actually those session would only TCP and/or SSL sessions created with the destination. Once URL category is matched, the final decision will be made if traffic needs to be allow or drop. I would recommend you to verify complete traffic logs by opening it and you will see what's actually getting allowed. ... View more

Hi @ChristianBolelli Will your peer allow ICMP traffic on their public IP ?   Also in addition to this - If they allows and you configure but it won't help you in some scenarios like given below - Your tunnel having issues like Phase-1 and/or Phase-2 is down. In this case, peer end public IP may respond to ICMP but tunnel resources may become unreachable.  ... View more

Hi @ChristianBolelli ,         Yes, you need to have separate VPN tunnel with secondary peer IP and  you need to assign the IP to the tunnel interface. You just need to make sure that the IP that you are assigning to the tunnel interface should be from your local network which is part of tunnel encryption domain. Basically that source IP should be reachable towards the destination servers over tunnel. If you are doing NAT for the existing tunnel traffic, then you need to do  NAT for tunnel interface IP also. This traffic will travel till destination via tunnel.     Once you have this set, you can enable the path monitoring on the tunnel.1 route i.e. Route 1 10.1.0.0/24 metric 10 Tunnel.1 and take one of the ICMP responding server from peer side to add it under path monitoring. Once Primary tunnel fails, configured destination server will stop responding to ICMP and once path monitoring fails, Palo Alto will remove route towards tunnel.1 from FIB. And traffic will then start sending to the secondary tunnel i.e. tunnel.2   Here, I have considered that you are trying to configure two tunnels (Primary & Secondary) for same encryption domain from your Palo Alto.   Hope it helps! ... View more

Hi @digdoug ,   You can create multiple IPSEC tunnels from your Palo Alto’s single external IP and different partner external IPs. Only thing you need to make sure of properly defining the VPN encryption domain, security and/or NAT policies and routing to differentiate traffic and forward it to right tunnel interface.   Hope it helps! ... View more

Hi @Martin_Kurniawan ,   You can refer below existing articles for Licensing Considerations on Cloud.   VM-Series for AWS and Azure Licensing Considerations VM-Series Firewall Licenses for Public Clouds   Hope it helps! ... View more

Hi @Fagani ,   We have option in Palo Alto to configure security policy based on source and/or destination region / countries / Geo-Location where you can define action (allow/deny) against same based on your requirement. If you want to allow traffic from one specific region & block rest, then you can have two policies where one will allow traffic from one region and other policy you will have to configure below allowed one. This second policy will block traffic from unwanted region. Below Palo Alto provided articles may help you with the configuration part. Also there is very good blog on this shared by @kiwi . Please check this to go through it. This will also help you.   Ref. Article 1 Ref. Article 2 Ref. Article 3 ... View more

Hi @yelfilali  For FQDN type object, you can do but you can't do it for wildcards under PBF. ... View more

Hi @yelfilali As the name FQDN object, so it can't be wildcard. It should be absolute domain name only. So whatever you are trying is not possible. ... View more

Hi @MinSeob-KWON ,   The configuration file/snapshot that you will export from the firewall will be xml file. That will include all the object groups, security/NAT polices, routes, profile config, interface/zone config etc. If you want to see the content of your config file, you can open it in the notepad++ or through api in web browser to see the content.   There are various Palo Alto provided articles available on it. Below are few of them for your ref. Ref. article 1 Ref. article 2     Hope it helps! ... View more