About kalavi

Dear Customer,   The  GlobalProtect Cloud Service Maintenance has been extended for another 24 hours and is scheduled to be completed by 6 PM PST on 12/24/2017.    Thank you, The Palo Alto Networks Support Team ... View more

Hi Ian, As per the description, I am assuming you might be doing the following: 1) Tying to add L3 interface and L2 in the same DMZ zone: It might not be possible because the Zones are defined based on Zone type, they should be either layer 3 or layer 2 or vwire or tap, we can not create a combination out of it. 2) If the above assumption is wrong, the next thing I can assume is that you are trying to configure two DMZ zone with same name but one for layer 3 and another for layer 2, that would also not be possible because by design we can not have two zone with same name even though they are of different type. Let us know if you are trying something else, we would try our best to respond you back as soon as possible. Thanks, Khubaib Alavi  ... View more

Hi, This is an expected error, the minimum subnet to create a gateway pool is /30. What you can try is to configure a pool in a different gateway just for that specific user. He will get the same IP address i.e. the 1st IP address from that pool every time he disconnects and connect back as there would be no other users who would be using that defined pool. This is just a workaround, what I would also suggest if you can do a feature request so that a user can be assigned a specific IP address based on HIP match, etc. Thanks, Khubaib Alavi ... View more

HI, Can you delete the GP client from the device itself (Under  Device--->GlobalProtect Client), download it again and re-install it. Now, from client access the portal again to download the client and try installing it. Thanks, Khubaib ... View more

Hi, The login credentials should have the Admin rights to read and write the logs. Let us know if you have any more questions. Thanks, Khubaib ... View more

Hi, PAN usually pulls out single category from Brightcloud server, if you feel like any website is marked under wrong category please open a case with support so that a request can be filed. The category will be verified and will be fixed in the next URL db release. Between, you can check the URL category from the following command on CLI: PAN> test url <website> Thanks, Khubaib ... View more

Hi, Please correct me if I am drawing the wrong topology Proxy (192.167.1.2)------DMZ-----(192.168.1.1) PAN ( 10.155.10.10) -------LAN-------(10.155.10.11) Client I am expecting there is no nat configured in between and the Client has a Gateway as 10.155.10.10 i.e. PAN's trust interface You need to check the following: 1) There should be security policy allowing the connection to go through from LAN to DMZ 2) Check if you can ping the gateway (i.e. LAN interface) from the client 3) Check if you can ping the proxy server from the PAN, use the following command on CLI: PAN> ping source 192.168.1.1 host 192.167.1.2 4) If you are note getting any response, you should check the gateway or route on the proxy server, you can also try to ping 192.168.1.1 from the proxy server 5) Check the arp entries on both the interface PAN> show arp ethernet1/x Let us know the results. Thanks, Khubaib ... View more

Hi, I think you might have enabled "single sign on" under the global protect setting on PAN firewall. With Single Sign on, the Client will use the windows credentials of the user to authenticate to the GlobalProtect Portal. This method is completely transparent to the end users. This might be causing your login issue, try disabling it on PAN then uninstall the GP client from the end user's machine. Download the client again and re-install it. Let us know if you have the same issue. Regarding your second query, you need to find which URLs does App Store tries to connect, based on that URL you can figure out the category, which can be done with the help of the following command on the CLI: PAN> test url <website> Allow those categories and see if you can access the App store without any issues. Thanks, Khubaib ... View more

Hi, Yes you can do it, first you need to save the "Named configuration version" and name it as per your convenience, and it will save the current candidate configuration on the device. Once saved, you can now use "Export named configuration" to export the configuration, that will be your candidate configuration for your records. Thanks, Khubaib ... View more

Hi, Can you clarify, what kind of report you want to generate based on the candidate config output? Thanks, Khubaib ... View more

Hi, I am assuming that you actual DNS server is on another zone and you have configured one of your interface as your DNS proxy, that way to allow the DNS request to go through you would need only dns apart from web-browsing and ssl. Here is the test that I ran, Client is 192.168.59.99 and configured with PAN's interface IP 192.168.59.1 as DNS Proxy , whereas the interface is configured to point 4.2.2.2 as the actual server, here is what the session looks like fro client to the interface: 199     dns            ACTIVE  FLOW       192.168.59.99[56708]/L3-Trust/17  (192.168.59.99[56708])vsys1                                     192.168.59.1[53]/L3-Trust  (192.168.59.1[53]) Here is the session from interface to 4.2.2.2: 193     dns            ACTIVE  FLOW  NS   192.168.59.1[58288]/L3-Trust/17  (10.30.6.59[22005])vsys1                                     4.2.2.2[53]/L3-Untrust  (4.2.2.2[53]) Both the sessions are identified as "dns". If you have same setup and you are having issues you should open a support case. Thanks, Khubaib ... View more

Hi, Yes, you can schedule the rule based on time stamps. The settings are under options of the policies, you can set the schedule for that specific rule with the URL profile. But we need make sure that the users who already has the session up and running, wont be blocked even if the rule came in effect, only the new users connecting would be blocked. Regarding the safesearch, you need to import custom Apps for google and bing. They can be found from the following link: https://live.paloaltonetworks.com/docs/DOC-1399 https://live.paloaltonetworks.com/docs/DOC-1657 You should be able to block those searches even if you are authenticating the users based on LDAP groups. If you are having issues, you can open a support case and any available engineer would help to create/import those custom apps. Thanks, Khubaib ... View more

Hi, Theoretically it can be done, but it would a complex network configuration. To get exact details you need to contact the SE's in your area. Thanks, -Khubaib ... View more

Hi, You can send both reports at the same time but you can not merge two different reports into one. -Khubaib  ... View more