About Carracido

Hello community!   When enabling sd-wan in physical interface the upstream NAT box will appear, but when enable sd-wan for a L3 aggregate subinterface, the Upstream NAT option will not appear. Does anyone know if upstream NAT is supported for such subinterfaces?   Cheers!  ... View more

Hello Community!   I´m trying to find a solution for the following problem:   I have two different forests created in the same Active Directory: Forest_1: subdomain_1.domain_1.com   Forest_2: subdomain_2.domain_2.com   There is a trust between the two forests   I have also the universal group_X in subdomain_1: subdomain_1\group_X   I added the User_Bob belonging to subdomain_2.domain_2.com into group_X   Is there any way to make the firewall map the User_Bob into group_X?   I tried several configurations but is not retrieving the mapping.   cheers. ... View more

Dear community!   I have configured split tunnel for both Both Network traffic and DNS and it works fine. However  while doing nslookups I get the  "Non-existent domain" error    According to the document down below, this can be fixed by setting "Resolve "All" FQDNs Using DNS Servers Assigned by the Tunnel (Windows Only)" option to NO. This option is already configured but we are seeing the issue anyways. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HB0rCAG&lang=en_US%E2%80%A9&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail   Any idea why this is happening?   Thank you! ... View more

Hi community!     Our firewall rebooted and after reboot we noticed the IPSec tunnels to Prisma Access did not restore automatically. Normally the IPSec tunnels come up when traffic is going through the tunnel. Do you know if this is a normal behavior with tunnels with Prisma Access?   Thank you in advance!  ... View more

Dear community!   I have a dual S2S VPN configuration with Prisma Access with static route path-monitoring as well as tunnel monitoring. The secondary tunnel is always down, only comes up when primary goes down. Do you know if this is expected behavior?   Thanks in advance!! ... View more

Dear community!   I have a quick question: Dos globalprotect support 2fa authentication with Linux smart cards?   Thank you! ... View more

Dear community,   For users who authenticate via RADIUS on Active Directory, is there any possibility to fetch the groups for those RADIUS users so that group-based policies can be created in the firewall?    Thank you! ... View more

Dear community!   We are observing the same behavior with ftp as explained here: https://live.paloaltonetworks.com/t5/general-topics/ftp-session-logged-as-2-tcp-sessions/td-p/49423   Like in the previous discussion we are observing traffic logs for the s2c flow of ftp traffic, it´s like the session splits up and generates a log for the c2s flow and also for the s2c one.  How is possible that a predict session can create a traffic log with the parameters of the s2c flow?   Thank you in advance for your answers.   ... View more

Dear community!   I´d like to consult with you for a possible solution for this scenario: We have 2 internet lines from two interfaces of the PAN firewall connected to two different routers. Each interface is in a different zone. When incoming and returning packets follow different paths then we have an asymmetric routing condition. Situation similar to this one: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClReCAK   We configured the firewall to bypass the non-SYN-TCP check but we still have packets dropped with counter "Packets dropped: forwarded to different zone"   Having both external interfaces in the same zone fixes the issue but we´d like to have them in different zones.   A possible workaround could be using a PBF as in this article: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClF5CAK But this is also not an option because the return mac entries supported is not big enough for all the incoming sessions, meaning the firewall will drop new sessions when table is full.   + Is there a workaround to bypass the "Packets dropped: forwarded to different zone" counter and allow the firewall to forward s2c traffic to a different zone?   Thank you! ... View more