About Daniel_Li

Thank you Sai. It is very useful link. Actually we are not able to get the excluded domain (zooom or www.cisco.com ) working. Ticket was in engineering escalation   Daniel ... View more

HI!   For Zoom domain excluded. So far it is not working. Symptom is not stable some client works and then stopped when they go zoom from Browser. It will not display. Case is on engineering team. If anyone got excluded domain working and stable. Please share your comments   Thank you   Daniel ... View more

Just update all   Split domain on GP 5.1.0 has bug and release note mention it is fixed on 5.1.2 or 5.1.1. So far it works on some machines and other machine is not working 100% for example following domain is in excluded list GP 5.1.1 or 5.1.2 *.zoom.us      -some GP client works and some does not *.cisco.com   -some GP client works and some does not speedtest.net  most of time this Domain traffic will send to physical adapter   Still not fix yet with Tech.   Daniel ... View more

Thank you Nehal for the useful link for troubleshoot.   I tried netstat -anob on window 10. It does not display adapter info for connection which shows connection to Zoom IP exiting at physical adapter. Pcap will show the info.   C:\WINDOWS\system32>netstat -anob | findstr 52 (52.202 is zoom.us IP) TCP 0.0.0.0:49666 0.0.0.0:0 LISTENING 1752 TCP GP IP.3:30390 52.202.62.232:443 CLOSE_WAIT 10596 TCP GP IP.3:31060 52.96.50.98:443 ESTABLISHED 2124 TCP GP IP.3:32232 52.96.50.130:443 ESTABLISHED 2124 TCP GP IP.3:32324 52.114.128.70:443 TIME_WAIT 0 TCP 127.0.0.1:1521 127.0.0.1:1522 ESTABLISHED 10436 TCP 127.0.0.1:1522 127.0.0.1:1521 ESTABLISHED 10436 TCP 192.168.0.17:3429 66.199.36.52:443 ESTABLISHED 7984 TCP 192.168.0.17:49420 52.177.166.224:443 ESTABLISHED 5080 TCP [::]:49666 [::]:0 LISTENING 1752 UDP 0.0.0.0:54908 *:* 2520 UDP 127.0.0.1:52597 *:* 2124 UDP [2607:fea8:329f:e653:e8b2:bccd:6d37:5242]:2177 *:* 2832 UDP [fd00:8494:8cd1:3322:e8b2:bccd:6d37:5242]:2177 *:* 2832 UDP [fe80::e8b2:bccd:6d37:5242%13]:1900 *:* 5988 UDP [fe80::e8b2:bccd:6d37:5242%13]:2177 *:* 2832 UDP [fe80::e8b2:bccd:6d37:5242%13]:59606 *:*   Daniel ... View more

Thank you Joe. Update is current. We have opened a ticket with TAC.   Daniel ... View more

HI !   I enabled trial license for Global protect gateway license and follow the link below to try to allow zoom traffic go out via physical adapter in Global protect client 5.1.0 PANFW firmware is 8.1.12. It does seems to be working. Does it require portal license in additiona to gateway subscribtion. If now how to prove it is working. Our tracert  zoom.us from GP client (full tunnel mode) still goes out tunnel (we did restart gp services/reboot client window OS)   Any suggestion is appreciated   https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/GlobalProtect-Implement-Split-Domain-and-Applications/ta-p/316929 ... View more

HI Sai   I installed 90 days trial Global protect gateway. Is that enough ?  It does not work after following the link.  tracert  zoom.us on Window 10 shows going thru tunnel interface, not physical one  ( restart GP service a few time, no access route configured ), I use GP 5.1 for window client. if add route in excluded access route. it works but zoom.us IP is changing sometime. Any suggestion is appreciated   Configuration is used in the link https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/GlobalProtect-Implement-Split-Domain-and-Applications/ta-p/316929     ... View more

Thank you SuperMario for the reply.   I have installed 90 days trial Global protect gateway. Is that enough ?  It does not work after following the link.  tracert  zoom.us on Window 10 shows going thru tunnel interface, not physical one  ( restart GP service a few time, no access route configured ), I use GP 5.1 for window client. Any suggestion is appreciated   Configuration is used in the link https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/GlobalProtect-Implement-Split-Domain-and-Applications/ta-p/316929       ... View more

I am trying setting up to split zoom traffic via physical adapter following the link. All traffic goes thru tunnel except zoom. I am not able to get it work without adding route in excluded access route. We have Gateway subscription license but not portal license.   Just want to confirm if we follow the following link (not mention adding route in excluded tab), Link says it needs Global protect license, Is it portal license or just gateway subscription license   Thank you   https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/GlobalProtect-Implement-Split-Domain-and-Applications/ta-p/316929 ... View more

Thank you Kelly. Is there guide (not admin guide) to configure multiple interfaces in a zone. For example, zone 1=ingress interface and zone 2= egress interface, or it can be mixed. Traffic from wan X enter interface 1 and exit interface 2 (WAN y will be interface 5, 6) and then enter interface 3 and exits interface 4 before they get on internet. Can I set up my zone Zone in=interface 1 and 5 Zone out=interface 4 so FTP (e.g) enter interface 1 and 5 and exit interface 4 will have only one session. On the other hand, I do not see anything wrong with two sessions per Application. but Firewall may be overloaded due to double inspection. I asked support some questions. i was told they need to talk with team to get back to me. Daniel ... View more

Thank you for the help. Two sessions means two Session IDs due to traffic passing PA device twice. ... View more

Thank you Rod. Glad to know that script is working on your network 1.   1st issue -- Are you using PA as corp firewall or just Vwire. we got two bugs after upgrading to 5.0.3 with network, we rolled back to 4.1.7h2. Currently waiting for last one bug fix 2.   2nd issue -- I had some screen shots of setting (not all) Basically we followed https://live.paloaltonetworks.com/docs/DOC-2020. Cert is on tested laptop and we did see pre-logon in admin webgui before alt,del and ctrl keys are pressed. We unchecked Ipsec and use SSL only.  but we did not put pre-logon (we use any)  in source user client configuration on page 50 of DOC-2020 Question:  Do you leave blank on LDAP configuration under Domain section ?                 Is VPN connection detail on GP client or on Admin GUI ? I am also waiting for bug fix ( we have already been hit by lots of bugs). So we have 85% CPU on Dataplane not sure what your DP usage during peak hours. Will do the GP test on the new firmware Thank you Daniel ... View more

logon scripts or Group Policy? ----logon script via AD (not using GP) SSO is enabled.  There is bug in 5.0.3 we revert back to 4.x. so not able to provide xml. but I need to know if anyone had it successful deployed. I can provide you case # if you have access to support portal ... View more