About Daniel_Li

Thank  you for the response. I will try out in the lab first.  ... View more

Hello Scott   As we has simlar issue on W10 with GP 5.1 or 5.2 for some users. I read this email about "Dug into our DNS..."  Is this setting on Corp DNS server ? or on Firewall. As IP scope is assigned by PANFW.  I guess it should be some setting on FW ? Please share your fixed setting if you can.   Thank you   Daniel ... View more

Thank you Sai. It is very useful link. Actually we are not able to get the excluded domain (zooom or www.cisco.com ) working. Ticket was in engineering escalation   Daniel ... View more

HI!   For Zoom domain excluded. So far it is not working. Symptom is not stable some client works and then stopped when they go zoom from Browser. It will not display. Case is on engineering team. If anyone got excluded domain working and stable. Please share your comments   Thank you   Daniel ... View more

Just update all   Split domain on GP 5.1.0 has bug and release note mention it is fixed on 5.1.2 or 5.1.1. So far it works on some machines and other machine is not working 100% for example following domain is in excluded list GP 5.1.1 or 5.1.2 *.zoom.us      -some GP client works and some does not *.cisco.com   -some GP client works and some does not speedtest.net  most of time this Domain traffic will send to physical adapter   Still not fix yet with Tech.   Daniel ... View more

Thank you Nehal for the useful link for troubleshoot.   I tried netstat -anob on window 10. It does not display adapter info for connection which shows connection to Zoom IP exiting at physical adapter. Pcap will show the info.   C:\WINDOWS\system32>netstat -anob | findstr 52 (52.202 is zoom.us IP) TCP 0.0.0.0:49666 0.0.0.0:0 LISTENING 1752 TCP GP IP.3:30390 52.202.62.232:443 CLOSE_WAIT 10596 TCP GP IP.3:31060 52.96.50.98:443 ESTABLISHED 2124 TCP GP IP.3:32232 52.96.50.130:443 ESTABLISHED 2124 TCP GP IP.3:32324 52.114.128.70:443 TIME_WAIT 0 TCP 127.0.0.1:1521 127.0.0.1:1522 ESTABLISHED 10436 TCP 127.0.0.1:1522 127.0.0.1:1521 ESTABLISHED 10436 TCP 192.168.0.17:3429 66.199.36.52:443 ESTABLISHED 7984 TCP 192.168.0.17:49420 52.177.166.224:443 ESTABLISHED 5080 TCP [::]:49666 [::]:0 LISTENING 1752 UDP 0.0.0.0:54908 *:* 2520 UDP 127.0.0.1:52597 *:* 2124 UDP [2607:fea8:329f:e653:e8b2:bccd:6d37:5242]:2177 *:* 2832 UDP [fd00:8494:8cd1:3322:e8b2:bccd:6d37:5242]:2177 *:* 2832 UDP [fe80::e8b2:bccd:6d37:5242%13]:1900 *:* 5988 UDP [fe80::e8b2:bccd:6d37:5242%13]:2177 *:* 2832 UDP [fe80::e8b2:bccd:6d37:5242%13]:59606 *:*   Daniel ... View more

Thank you Joe. Update is current. We have opened a ticket with TAC.   Daniel ... View more

HI !   I enabled trial license for Global protect gateway license and follow the link below to try to allow zoom traffic go out via physical adapter in Global protect client 5.1.0 PANFW firmware is 8.1.12. It does seems to be working. Does it require portal license in additiona to gateway subscribtion. If now how to prove it is working. Our tracert  zoom.us from GP client (full tunnel mode) still goes out tunnel (we did restart gp services/reboot client window OS)   Any suggestion is appreciated   https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/GlobalProtect-Implement-Split-Domain-and-Applications/ta-p/316929 ... View more

HI Sai   I installed 90 days trial Global protect gateway. Is that enough ?  It does not work after following the link.  tracert  zoom.us on Window 10 shows going thru tunnel interface, not physical one  ( restart GP service a few time, no access route configured ), I use GP 5.1 for window client. if add route in excluded access route. it works but zoom.us IP is changing sometime. Any suggestion is appreciated   Configuration is used in the link https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/GlobalProtect-Implement-Split-Domain-and-Applications/ta-p/316929     ... View more

Thank you SuperMario for the reply.   I have installed 90 days trial Global protect gateway. Is that enough ?  It does not work after following the link.  tracert  zoom.us on Window 10 shows going thru tunnel interface, not physical one  ( restart GP service a few time, no access route configured ), I use GP 5.1 for window client. Any suggestion is appreciated   Configuration is used in the link https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/GlobalProtect-Implement-Split-Domain-and-Applications/ta-p/316929       ... View more

I am trying setting up to split zoom traffic via physical adapter following the link. All traffic goes thru tunnel except zoom. I am not able to get it work without adding route in excluded access route. We have Gateway subscription license but not portal license.   Just want to confirm if we follow the following link (not mention adding route in excluded tab), Link says it needs Global protect license, Is it portal license or just gateway subscription license   Thank you   https://live.paloaltonetworks.com/t5/Prisma-Access-Articles/GlobalProtect-Implement-Split-Domain-and-Applications/ta-p/316929 ... View more

Thank you Kelly. Is there guide (not admin guide) to configure multiple interfaces in a zone. For example, zone 1=ingress interface and zone 2= egress interface, or it can be mixed. Traffic from wan X enter interface 1 and exit interface 2 (WAN y will be interface 5, 6) and then enter interface 3 and exits interface 4 before they get on internet. Can I set up my zone Zone in=interface 1 and 5 Zone out=interface 4 so FTP (e.g) enter interface 1 and 5 and exit interface 4 will have only one session. On the other hand, I do not see anything wrong with two sessions per Application. but Firewall may be overloaded due to double inspection. I asked support some questions. i was told they need to talk with team to get back to me. Daniel ... View more