Hi @Dan_Fleming    When you override interfaces in the firewall , virtual router also will be overrided. Check the icon colour near by  Virtual router name  , if it is fully green it will accept changes from panorama . If it is partially green and yellow it will not accept changes from the panorama push.   Thanks, Ram ... View more

HI @fd9999    The best solution will be to create an internal gateway , so the GP agent can connect to internal gateway and users will get internet through the firewall.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClH1CAK   Thanks, Ram     ... View more

Hi @OwenFuller ,   Yeah , please try and let me know how it went . thanks, Ram ... View more

 Hi ,   You are welcome , there is no impact in the existing portal , you can test this parallely. Thanks, Ram ... View more

Hi @Rajendranahak    I can suggest one more option as well. if you have only one public ip still you can customize the portal for the 2nd portal using the same public IP. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGKCA0 Hope it helps. Thanks. Ram ... View more

HI @simsim , Assume we have ISP of 10 mbps , can we get 20 mbps using any device . The answer is certainly "NO".  in such a way pa is receiving only 10 mbps so it cant be increased . Any device cannot increase the bandwidth more than it recieved. Hope it helps Thanks, Ram ... View more

Hi @simsim    No , Paloalto cannot override the QOS tweak done by fortinet. In this scenario it would be better to maintain QOS policies in only a single device ( FG or PA). Thanks, Ram  ... View more

Hi @Rajendranahak    Prelogin cannot be restricted based upon the usernames because there is no username involved during the process. Prelogon is based upon the agent configuration which was received from the portal during the previous successful connection with the portal. Prelogon only for specific users can be achieved by creating two portals ( portal with prelogon and portal without prelogon) . make sure users who require prelogon should connect to the prelogon portal and users who doesnt require prelogon should connect to the other. Please try and let me know. You can check these config with test users to avoid a production interruption for GP users.   The other way is using a client certificate , and the laptops which has the certificate can be forced for prelogon.    Thanks, Ram ... View more

Hi @Swetang    I dont think so you can use DAG for this requirement ,    ... View more

Hi @Swetang    I believe there is no direct way to do this. Anyhow if you have a global protect license you configure internal gateway and configure hip based policies where you can use hostname , serial number , os type etc as parameters. https://docs.paloaltonetworks.com/globalprotect/8-1/globalprotect-admin/globalprotect-quick-configs/globalprotect-for-internal-hip-checking-and-user-based-access.html   Please try and let me know,   Thanks, Ram ... View more

Hi @rbottiglieri    I suspect the security policy in the firewall. Just to isolate , is it possible to create a plain firewall rule for the test machine by allowing all the traffic in the firewall.  Also untrust interface outbound NSG 'allow all' and trust interface inbound NSG 'allow all'.   Thanks, Ram ... View more

Hi @rbottiglieri , Please make sure you have a PublicIP assigned to your untrust interface . In Azure Ping and traceroute will not work if you didnnt have a public IP in the untrust interface. Please try and let me know,   Thanks, Ram ... View more