About tsrivastav

For limiting download  --------------------------------   Apply QOS on you Lan interface ( which will be the  egress port  for  download traffic ) use a class to limit band width ( dont use class 4 ) Note if you are using clear text tab make sure the source interface will be your wan interface if you are limiting download       Write QOS policy according to your need per user / per subnet / per group as shown in above comment.       ... View more

From the above description i understand that you only want to use multiple gateway so that you can have different authentication profile for different users   If  you have used one ip adderss as your gateway you  will not be able to call the same ip address again to create a gateway again.   # One solution for your requirement is to use Authentication Sequence.   # Call multiple auth profile in authentication sequence and call this auth sequen under your gateway( in place of auth profile )   some details for auth sequence    In some environments, user accounts reside in multiple directories (for example, local database, LDAP, and RADIUS). An authentication sequence is a set of authentication profiles that the Palo Alto Networks device tries to use for authenticating users when they log in. The device tries the profiles sequentially from the top of the list to the bottom—applying the authentication, Kerberos single sign-on, allows list, and account lockout values for each—until one profile successfully authenticates the user. The device only denies access if all profiles in the sequence fail to authenticate.    I hope this may fulfil you requirements    Thank You ... View more

https://live.paloaltonetworks.com/t5/Configuration-Articles/Google-Services-are-Not-Decrypted-when-Accessed-from-Chrome/ta-p/65518   Please check the above document  if you do not want to make a change on the firewall if it works you can deny the same on the firewall.   type the below string  on chrome   chrome://flags ctrl+f  search for quic and disable it, test the changes and  let us know.   Thank you    ... View more

  If you are unable to see the below link follow the detailes mentioed above   https://live.paloaltonetworks.com/t5/Internal-Knowledge-Base/Captive-portal-not-working-with-HTTPS-Sessions/ta-p/78346   ... View more

Captive portal not working with HTTPS Sessions      Follow the below procedure to get the user name always for the captive portal users   Remedy for this is to implement ssl decryption with a way described below   Prerequisite: ------------------- Knowledge of ssl decryption. Knowledge of captive portal.   Non working scenario. 1- Unknow user from the wireless zone tries visiting https://www.google.com 2- Since its a SSL session, the captive portal page may not trigger. 3- Firewall was unable to know who was the user as he does not got a CP page.   use ssl decyption   Working screnario --------------------- >Decryption policy 1 says no decrypt to wireless known users. >Decryption policy 2 says  decrypt all the traffic from comming from wireless zone.   1- Unknown user from the wireless zone tries visiting https://www.google.gom. 2- Decryption policy 2 triggers and provides a CP page. 3 - Unknown user again tries visiting any other https site, the CP page was prompted again because of Decryption policy number 2. 4- User enters his credentials and is a part group  captive-portal-grp ( we are using AD for authenticating CP users ) 5- Now the firewall is aware of the user and decryption rule number #1 will trigger and will not decrypt any further traffic from the known user and user will not get a certificate warning page. 6- Security policy also needed in place based on group and zone individually. ( create a group specific policy on the top and a zone specific below that )    ... View more

    Even we have a app-id for the same but the application depends on ssl also. Hence we require an ssl decryption ( either for custom category or for web-based email )  to make it work properly you can also block attachment through the same if needed when ssl decrytpion in place ... View more

  Screen shots from the release notes of pan os 7.0.0 ... View more

The best way to verify the same is referring to the release notes of the base image. Please open the release notes and click on the Associated Software Versions    From there you can check Minimum Supported Version with PAN-OS 7.0 ( For user-id and other soft. etc )     ... View more

Hope the above attachment will answer your question. --------------------------------------------------------------------------   # You can call this vulnaribility profile in the intrested security policy ( if the traffic is from unt to unt or a intrazone traffic ) # Please create a seperate security policy as default intrazone profile will not contain this Vul. Profile. #Clone a default one to make the changes as in default one you will not be able to make any changes.   # Default action is alert, Change the action and number of attempts as per your needs.   Thank you     ... View more

DNS resultions are working fine, that means changing service route  may not address the isse however if the traffic is passing through the firewall Mgmt port>>>firewalls data port>>>cloud  make fure you have allow rules for Managment ip address more or you can check global counters also if the traffic is passing through the firewalls data port ... View more

  Could you be able to check the Time and date on ther firewall are accurate or not Also kindly open the cli run this command and  do a check now paste the output here    admin@admin> tail follow yes mp-log devsrv.log       and do you see any message in the system logs regarding to the url filtering      ... View more

If you want to  configure a NAT rule you should be having an ip address on the interface either statically or assisgned via DHCP   Else that will  be a Not nat rule for the traffic   Are you trying to  use tunnel interface in NAT rule  ?  ... View more

Try installing the certificate in the other accounts too   try with IE also    try installing the same in other accounts too   ... View more

Have you tried enabling/disabling  DPD and kindly check in case  you have enabled passive  mode  disable the same and do the fail over to test the results    ... View more

All the Tunnels are between Palo Alto -- Palo Alto   ? and kindly  update the pan os version as .that would be helpful in finding the cause ... View more

Kindly Mention the error message  which you get when  trying to download  the same it will surely help to find the Root cause of the issue ... View more

A new feature was introduced in PAN OS 6.1 To disable the Login page on Portal If you will Enable this Feature and when the user will visit to the portal by https://portal address the page will not be presented to him however with the GP client he will be able to connect The error which the user will get with this option checked is https://portal address 404 page not found So if you want your users to see the Portal page kindly Disble the same ... View more