About Ameya-Kawimandan

Is this because the Captive Portal policy for this subnet is active (and cannot be controlled by a schedule).  Please elaborate if I misunderstood how to do this? CP page would be prompted as long as the HTTP GET request/HTTPS transaction reaches firewall's CP zone. Applying  schedules to the security rule that allows applications dns and web-browsing for unknown-users would ensure that DNS resolution and web-traffic only succeeds during the desired schedule, indirectly controlling the prompting of CP auth page. Also there is abosolutely not way to 'log off' a PanOS captive portal session?  Occasionally we make public computers available and it would be nice if the current user was able to log out before letting another user continue browsing the internet. Firewall sets a cookie so that future login requests become transparent to the user using session cookies in redirect mode, if the browser has not been closed, Try disabling this option so that a new user has to login when the current user closes the browser window. Currently there is no option to log off a CP user. HTH, Ameya ... View more

These settings are for the locally configured firewall administrators. I think the original question was pertaining to (Device > Local User Database > Users) Excerpt from Admin Guide: "Enable minimum password requirements for local accounts. With this feature, you can ensure that local administrator accounts on the firewall will adhere to a defined set of password requirements." ... View more

VWIRE mode with following settings should be a good way to start. 1> All the tags allowed 0-4094 2>Non-Syn-tcp-reject  turned off 3>assymetric bypass tuned on These settings would ensure that PA  functions as a transparent device, staying inline. Security features can be selectively turned on an ad hoc basis. -HTH...! ... View more

I believe you are referring to the following test cases: Can GlobalProtect Portal Page be Configured to be Accessed on any Port? Access to GP Portal need open access to port 443 on the external interface IP which can make it vulnerable. For additional security loopback interface can be used to host GP services on a non-default port , where a GP user connects to GP portal on an external IP + non-default port socket which gets translated to loopback + port 443. How to Configure Global Protect Gateway On Loopback Interface with iPhone Access Exhibits how non-ssl services like Outlook web access can be hosted External IP using Loopback. HTH..! ... View more

If these users need connect from the outside/internet, enabling CP on WAN interface would be taxing for the firewall resources. Only alternative that I can think of is using Global Protect configured with External Gateway. Users can connect to GP portal/gateway and authenticate using their AD/Radius/Kerberos/Local DB  credentials and would be assigned an IP from the configured IP pool. Security policies can be configured between the tunnel zone and Inside zone to access the RDP server. Plus....GP (1Portal + 1Gateway ) does not need licenses starting OS_4.1.x HTH..! ... View more

If by losing the interface, you mean accessing HTTPS service on eth1/4. You need to access this interfaces on port 4443 How to Access the WebUI when GlobalProtect Is Enabled ... View more

Just to be clear, with OS-5.0 you may use to the User-ID collector feature to pass on User-IP mappings (Captive Portal, GP mappings) from firewall A to B (User ID collector OS-5.0) firewall. But the option to selectively pass only GP User-IP mappings is not available. Ref How to Configure and Verify User-ID Collector in PAN-OS 5.0 ... View more

Service account should be part of Distributed COM Users, Server Operators and Event Log Readers groups Following document enlists the rights needed. It applies for Agent and Agentless UserID. How to Configure Agentless User-ID in PAN-OS 5.0.x ... View more