About tsrivastav

For limiting download  --------------------------------   Apply QOS on you Lan interface ( which will be the  egress port  for  download traffic ) use a class to limit band width ( dont use class 4 ) Note if you are using clear text tab make sure the source interface will be your wan interface if you are limiting download       Write QOS policy according to your need per user / per subnet / per group as shown in above comment.       ... View more

From the above description i understand that you only want to use multiple gateway so that you can have different authentication profile for different users   If  you have used one ip adderss as your gateway you  will not be able to call the same ip address again to create a gateway again.   # One solution for your requirement is to use Authentication Sequence.   # Call multiple auth profile in authentication sequence and call this auth sequen under your gateway( in place of auth profile )   some details for auth sequence    In some environments, user accounts reside in multiple directories (for example, local database, LDAP, and RADIUS). An authentication sequence is a set of authentication profiles that the Palo Alto Networks device tries to use for authenticating users when they log in. The device tries the profiles sequentially from the top of the list to the bottom—applying the authentication, Kerberos single sign-on, allows list, and account lockout values for each—until one profile successfully authenticates the user. The device only denies access if all profiles in the sequence fail to authenticate.    I hope this may fulfil you requirements    Thank You ... View more

https://live.paloaltonetworks.com/t5/Configuration-Articles/Google-Services-are-Not-Decrypted-when-Accessed-from-Chrome/ta-p/65518   Please check the above document  if you do not want to make a change on the firewall if it works you can deny the same on the firewall.   type the below string  on chrome   chrome://flags ctrl+f  search for quic and disable it, test the changes and  let us know.   Thank you    ... View more

Is the server is located behind the firewall and you are trying to ping from outside ? ( nat and security policy needs to be checked ) If that is not the case then it may also happen the new sessions are getting matched with the old discard sessions.   Most likely as me peers mentioned above either the deny policy is above the allow policy or there the zones and the ips needs to be cross checked once again   Tarang ... View more

By  mistake clicked on me too.    Anyways : ------------------------   Have you tried assigning that IP address you are using for source NAT on any interface like a secondary ip just for troubleshooting purposes and then try pinging to the next  hop using that natted ip  address as a source. Also try sending a G-arp  packet after the same to see the resluts    The above step is just to see that Ip has a back and forth reachability  from the internet or not  as if that ip itself is not rechable as a source to the next hop the host machines will never be able to reach to the internel  using that as a natted source ip address   Also please let me know are you  using single VR or 2 virtual routers.     ... View more

  If you are unable to see the below link follow the detailes mentioed above   https://live.paloaltonetworks.com/t5/Internal-Knowledge-Base/Captive-portal-not-working-with-HTTPS-Sessions/ta-p/78346   ... View more

Captive portal not working with HTTPS Sessions      Follow the below procedure to get the user name always for the captive portal users   Remedy for this is to implement ssl decryption with a way described below   Prerequisite: ------------------- Knowledge of ssl decryption. Knowledge of captive portal.   Non working scenario. 1- Unknow user from the wireless zone tries visiting https://www.google.com 2- Since its a SSL session, the captive portal page may not trigger. 3- Firewall was unable to know who was the user as he does not got a CP page.   use ssl decyption   Working screnario --------------------- >Decryption policy 1 says no decrypt to wireless known users. >Decryption policy 2 says  decrypt all the traffic from comming from wireless zone.   1- Unknown user from the wireless zone tries visiting https://www.google.gom. 2- Decryption policy 2 triggers and provides a CP page. 3 - Unknown user again tries visiting any other https site, the CP page was prompted again because of Decryption policy number 2. 4- User enters his credentials and is a part group  captive-portal-grp ( we are using AD for authenticating CP users ) 5- Now the firewall is aware of the user and decryption rule number #1 will trigger and will not decrypt any further traffic from the known user and user will not get a certificate warning page. 6- Security policy also needed in place based on group and zone individually. ( create a group specific policy on the top and a zone specific below that )    ... View more

    Even we have a app-id for the same but the application depends on ssl also. Hence we require an ssl decryption ( either for custom category or for web-based email )  to make it work properly you can also block attachment through the same if needed when ssl decrytpion in place ... View more

  Screen shots from the release notes of pan os 7.0.0 ... View more

The best way to verify the same is referring to the release notes of the base image. Please open the release notes and click on the Associated Software Versions    From there you can check Minimum Supported Version with PAN-OS 7.0 ( For user-id and other soft. etc )     ... View more