About CharlesKoh

Hi,   Any idea or solution to use api to logged out Prisma Access globalprotect connected mobile users? ... View more

Hi all, I like to ask if it is possible, and and hot to build a scalable solution for AD grouping info to all firewalls managed by panaroma so that they can create firewall rules based on user id and grouping.    Current environment I am testing: 1 panorama 1 VM firewall configured as standalone master device in a device group. It queries AD, look into syslog and connect to other userid agents(global protect internal and Prisma) to get user id information   Other firewalls in the environment configured userid agent pointing to the VM to learn all the userid to IP mapping info   How should I improve on this existing setup to further learn AD grouping info? So that I can build firewall rules using group info? Else using individual username is too much of a chore to maintain.    Thankyou   ... View more

Hi all,   i have some questions regarding community settings because we use this in our org to influence routes selection. Based on this document "https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prepare-the-prisma-access-infrastructure/route-preferences-for-service-connection-traffic.html"   1) Are the communities referred in it "65534:X " "65534:Y " "65534:Z " refers to the prisma mobile users IP pools allocation setting per region?   2) When we clicked on the BGP status, network detailed of the service connections, the community number shown in it refers to what? The X Y Z which i mentioned in point 1 above? I have 3 service connections (2 in US and 1 in EU and none in Asia).. these 3 service connections gave me different community numbers, so which is which region? 3) The document only mentioned about mobile users IP prefixes.. I also uses Remote Network (traditional IPSEC) into Prisma.. i like to control the return routes of which service connection to be use based on community.. how do we do what community is being set based on the Prisma Access Locations? Is there a list published somewhere on the community numbers? If i checked on the IP prefix of the remote site specifically, i do see a community tag to it... searching all the BGP Ip prefix will be a big chore, will be good if the community numbers tagging is published somewhere.     ... View more

Hi, are there currently any ways for us to monitor the utilization for these cloud services? ... View more