Hi,   do you remember the last situation of this problem ? were you able to solve it ?(and how)   Regards     ... View more

hi,   we solved the issue with defining a log card interface.Although defining that port was mandatory for 8.1 regarding to Admin guide , it was working fine without that interface.Management interface can forward logs without this port at 8.1 and this was an internal bug , paloalto Tac confirmed. Also if you define only subinterface as log card with ip ,it also fails.So an ip(it can be fake) should be given to log card main interface directly and then subinterface with ip works.   Regards ... View more

Hi,   yes nslookup works fine We also tried the following: deleted fqdn vpn completely, configured new portal/gw and certificate with same ip.so that we were able to connect with ip. But those clients still had same error. tried every agent, 4.1.x,5.0.x,5.1.x no success   ... View more

Hi, created Tac case for this but still no fix,waiting for support. ... View more

Hi,   we have same issue with 2 clients. also there is something weird about the issue at our system.these 2 clients can connect to our backup portal/gw, but main portal/gw doesn't work with "no network connectivity" error.There are over 30 users ,only 2 users have this issue.Tried 5.0,5.1,5.2 all same. I will try 4.x   Regards     ... View more

Hi   it is not supported with dynamic   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmrSCAS ... View more

By the way, you  will not be able to upgrade 3020 to panos 10. 9.1.x supported but 10 not.   Regards ... View more

Hi   any update on this ?   Thanks ... View more

hi,   any update on this ? or Still not possible ?   Thanks ... View more

Hi,   using the command   debug l3svc reset user-cache ...   and clearing user cache and mp user cache works   You have to use both   Regards   ... View more

Hi,   create 2 virtual routers with 2 seperate default gateways.That will be better. you can then create 2 different global protect 1 for main,1 for second isp.your Lan and isp1 will be at default, your isp2 will be at new virtual router.Then you will also add a LAN- next vr default vr route at new virtual router.   you can use pbf for main with monitor and 2nd pbf rule will route clients to isp2     Regards   ... View more

Hi,   You can see details from here   https://live.paloaltonetworks.com/t5/Management-Articles/Selecting-an-IP-Address-for-PBF-or-Tunnel-Monitoring/ta-p/61993   https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Verify-if-IPSec-Tunnel-Monitoring-is-Working/ta-p/56466   Regards   Regards   ... View more