About ccscott

I've had some luck with the "logon lifetime" config on the GP gateways, although it can be annoying for users who just leave the machine up and actually connected. I know It's not actually the same, but it can force reauth.    I think the original poster is best off using the HIP check timeout "Inactivity Logout" and maybe seeing if something else is available down the road feature-wise. ... View more

This is my experience with windows endpoints too. They are just to chatty. If the users powers off or closes the lid then yeah they might go "idle".    When you refer to license count, what do you mean? As I understand it the global protect license is for the whole box not per user.  ... View more

Seems like more of a winodws issue, but I'd like to ask, how are most people actually handling ddns updates while clients are on global protect vpn? Non windows dns here.  ... View more

Posting just to see how this turns out. I can see this in our future.  ... View more

Correct support for this client is not great.  ... View more

The basic pre logon KB article is very dated at this point and isn't clear on certificates. Support usually doesn't want to mess with pre logon cases and just refers us to the same dated KB article.  ... View more

So I get this error too, but on Centos   Oddly enough I don't get this certificate error with connecting to the same gateways via another portal.    The main differences is the other portal has a GP license, which according to support is not needed.    No other OS has the issue.  ... View more

I've always been afraid of this product and honestly trust my own scripts more. Why? Because the docs for it are too high level and don't give me enough detail on how configs are merged, replaced, overwritten, etc. I need to know exactly what will be pushed but its all so cryptic, especially for those of us that didn't start off managing our firewalls with this tool. All I want is shared object management for the most part.    I would use Panorama if it had a juniper-style | compare instead of what Palo has in the GUI and if there was a commit-confirm rollback.  ... View more

Honestly I would say Palo TAC has taken a big nosedive recently. Seems like all the frontline employees either just stall or are purely gatekeepers. I don't use support often, just when something isn't behaving as documented, but more often than not recently I've been ver disappointed.  ... View more

I have no problem creating a no captive portal policy for certain servers and workstations. But we have quite a few macs that are not on the windows domain and the ones that are are not logging their ip/username combination for the firewall to learn from AD. Most windows users should be doing this through wsus server anyway. But the main issue is that the application identification is not working well enough for these apps to permit them through unless ssl/other application is also enabled for any user through basically a permit any any policy at the bottom of the rule base. This kind of goes against the postive enforcement approach that Palo Alto encourages. In fact it is much easier to block an app as you basically have to only break one part of it whereas you mush be able to identify and enable all flows/traffic with the postive enforcement approach. I'm very impressed with PA firewalls in general. We use then in a few spots in our network already and are moving to them for our main enterprise firewall (I'm testing all of this on a test PA=5050 unit by the way). I have an SE working with me on this and if I were on a supported unit would just submit a ticket with support. ... View more

I've done just that but am still having issues. Seems the issue I'm having with ms-update is related to the fact that part of the sessions are not identified as ms-update but instead ssl (seems to be just one of them)   Out of the box yum works pretty well it seems but when extra repo's are configured on the linux machine it is not identified as yum. I can verified that this traffic is being affected by captive portal because as soon as I disable the captive portal policy it works correctly. Seems like windows doens't like the self-signed cert or redirect it sees when it hits cp. ... View more