About RamprakashRT

RamprakashRT

HI @fd9999 The best solution will be to create an internal gateway , so the GP agent can connect to internal gateway and users will get internet through the firewall. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClH1CAK Thanks, Ram

RamprakashRT · ‎08-13-2020

Hi @OwenFuller , Yeah , please try and let me know how it went . thanks, Ram

RamprakashRT · ‎08-13-2020

Hi , You are welcome , there is no impact in the existing portal , you can test this parallely. Thanks, Ram

RamprakashRT · ‎08-13-2020

Hi @FarzanaMustafa Currently exemption is allowed only for single ip address not a subnet. Suggesting a workaround, 1)Clone the vulnerability profile and create the exemption ( without ipaddress) 2)create a new security policy with desired range, subnet as source and assign the new vulnerability profile ( cloned one). Hope it helps. Thanks, Ram

RamprakashRT · ‎08-13-2020

Hi @Rajendranahak I can suggest one more option as well. if you have only one public ip still you can customize the portal for the 2nd portal using the same public IP. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGKCA0 Hope it helps. Thanks. Ram

RamprakashRT · ‎08-12-2020

HI @simsim , Assume we have ISP of 10 mbps , can we get 20 mbps using any device . The answer is certainly "NO". in such a way pa is receiving only 10 mbps so it cant be increased . Any device cannot increase the bandwidth more than it recieved. Hope it helps Thanks, Ram

RamprakashRT · ‎08-12-2020

Hi @simsim No , Paloalto cannot override the QOS tweak done by fortinet. In this scenario it would be better to maintain QOS policies in only a single device ( FG or PA). Thanks, Ram

RamprakashRT · ‎08-12-2020

Hi @Rajendranahak Prelogin cannot be restricted based upon the usernames because there is no username involved during the process. Prelogon is based upon the agent configuration which was received from the portal during the previous successful connection with the portal. Prelogon only for specific users can be achieved by creating two portals ( portal with prelogon and portal without prelogon) . make sure users who require prelogon should connect to the prelogon portal and users who doesnt require prelogon should connect to the other. Please try and let me know. You can check these config with test users to avoid a production interruption for GP users. The other way is using a client certificate , and the laptops which has the certificate can be forced for prelogon. Thanks, Ram

RamprakashRT · ‎08-11-2020

Hi @Swetang I dont think so you can use DAG for this requirement ,

RamprakashRT · ‎08-10-2020

Hi @Swetang I believe there is no direct way to do this. Anyhow if you have a global protect license you configure internal gateway and configure hip based policies where you can use hostname , serial number , os type etc as parameters. https://docs.paloaltonetworks.com/globalprotect/8-1/globalprotect-admin/globalprotect-quick-configs/globalprotect-for-internal-hip-checking-and-user-based-access.html Please try and let me know, Thanks, Ram

RamprakashRT · ‎08-06-2020

Hi @raji_toor , Great question . As per my understanding established sessions will not follow the route lookup so in this case it will continue to use ISP 2 once the ISP 1 became active. New sessions initiated will route through ISP 1. Hope it helps. Thanks, Ram

RamprakashRT · ‎08-06-2020

Hi @raji_toor , Yes this is possible. You need to assign one Vsys as a userid hub ( centralized storage for all the user id ) which can be accessible by other vsys. You can make use of the below link, https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/user-id-features/shared-user-id-mapping-across-virtual-systems Try and let me know. Thanks, Ram

RamprakashRT · ‎08-05-2020

Hi @rbottiglieri I suspect the security policy in the firewall. Just to isolate , is it possible to create a plain firewall rule for the test machine by allowing all the traffic in the firewall. Also untrust interface outbound NSG 'allow all' and trust interface inbound NSG 'allow all'. Thanks, Ram

RamprakashRT · ‎08-05-2020

Hi @rbottiglieri , Please make sure you have a PublicIP assigned to your untrust interface . In Azure Ping and traceroute will not work if you didnnt have a public IP in the untrust interface. Please try and let me know, Thanks, Ram

RamprakashRT · ‎08-02-2020

Hi @vsys_remo Thanks for the clarification , got it now. Thanks, Ram

RamprakashRT · ‎08-02-2020

hi @srsairbag99 , NAT policy will be evaluated only after the route lookup, so as per PBF if it is going to ISP 1 it will use the NAT policy for ISP 1 , if PBF fails and if the traffic goes to ISP 2 NAT policy of ISP 2 will be used. Please use destination interface as relevant interfaces of ISP. Thanks, Ram

RamprakashRT · ‎07-31-2020

Hi@srsairbag99, Yeah, this is correct there is a limit in the number of translation. For source NAT using different public ips for LAn pools is the right way. In destination nat , you should enable the source translation to the interface ip , to ensure the return traffic is coming to the right isp. As you are using PBF the source NAT is required. Thanks, Ram

RamprakashRT · ‎07-31-2020

Hi , Please try diabling SIP alg, https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEsCAK Thanks, Ram

RamprakashRT · ‎07-31-2020

HI , When you are using BGP tunnel monitoring is not required for failover . Create export and import priority in BGP for Active and Passive tunnels. It should work seamless. Please try and let me know, Thanks, Ram

RamprakashRT · ‎07-31-2020

Hi , QOS policy is evalauted before the NAT, so always it should be for Pre-NAT ip. Thanks, Ram

RamprakashRT · ‎07-31-2020

Hi , Try creating a application override policy where source as GP client ips destination as 10.0.0.0/8 subnets on required ports . So the firewall not process this traffic for app identification . Try and let me know. Thanks, Ram

RamprakashRT · ‎07-31-2020

Hi , I am not sure about bypassing gucamole login page. Suggesting an alternate , as this is POC you can try SAML authentication of SecurEnvoy for global protect client authentication . Configure the SAML in gucamole as well. Once the client enters the GP clienless VPN and click on the Gucamole link it tends to reuse the existing credentials of clientless VPN to gucamole , so you can bypass the procedure of reentering the credentials. Thanks, Ram

RamprakashRT · ‎07-31-2020

Hi , Please make sure that loopback IP is reachable to Panorma on required ports and Viceversa. If NAT is involved make sure it is bidirectional NAT as communication between Panorma and firewall is bidirectional. Thanks, Ram

RamprakashRT · ‎07-31-2020

Hi , I had faced this issue in the past . As per my experience I was unable to import certificate through chrome browser irrelevant to PAN OS versions. You can give a try with IE or firefox and it works. Thanks, Ram

RamprakashRT · ‎07-31-2020

Hi. Outbound traffic : If your both ISP are almost equivalent bandwidth you can use ECMP using IP modulo or IP hash algorithm. If they are not then use PBF to route the traffic to internet based on the source LAN subnets. NAT : Source Zone : Trust Destination Zone : Untrust Source address : LAN pool Destination address : any Destination interface : ISP 1 interface Source Translation : ISP 1 interface IP Source Zone : Trust Destination Zone : Untrust Source address : LAN pool Destination address : any Destination interface : ISP 2 interface Source Translation : ISP 2 interface IP Outside to DMZ Server Destinatian NAT ( Active - Active ) ECMP enabled : In ECMP settings make sure Symmetric return is enabled. Create Destination NAT policy ( do not create Bidirectional NAT) Source ZONE : Untrust Destination Zone : Untrust Source Address : any Destination Address : ISP 1 pubic IP source translation : none destination translation : DMZ private IP Source ZONE : Untrust Destination Zone : Untrust Source Address : any Destination Address : ISP 2 pubic IP source translation : none destination translation : DMZ private IP ECMP not enabled : Create an Dummy Alias Interface IP in ISP 1 interface and ISP 2 interface Create Destination NAT policy ( do not create Bidirectional NAT) Source ZONE : Untrust Destination Zone : Untrust Source Address : any Destination Address : ISP 1 pubic IP source translation : Dummy Alias ISP 1 destination translation : DMZ private IP Source ZONE : Untrust Destination Zone : Untrust Source Address : any Destination Address : ISP 2 pubic IP source translation : Dummy Alias ISP 2 destination translation : DMZ private IP. Hope it helps , please let me know for any clarity. Thanks, Ram

Date Registered	‎07-11-2020 10:27 AM
Date Last Visited	11 hours ago
Total Messages Posted	25
Total Likes Received	7

Online Status	Offline
Date Last Visited	11 hours ago

Strata

Prisma

Cortex

About RamprakashRT