About TruongQuocAn

I submitted 1 new app (by that URL)  3 or 4 months ago but no one care about it. I did not receive any feedback from palo alto. ... View more

Finally, I knew what I had missed. That's the destination must have web service running. If the destination PC don't have an installed web server, the captive portal won't appear. Thank you very much, Slawek. By the way, how do users logout their account that they've authenticated on captive portal ? ... View more

In fact, my situation is: - Create two zones: zone A and zone B. Some PCs in zone A need to VNC remote to some PCs in zone B. - I want to limit VNC connection. For example:      + user1A in zone A can only VNC to PC1B in zone B, not all PCs in zone B.      + user2A in zone A can only VNC to PC2B in zone B, not all PCs in zone B.      + usernA in zone A can only VNC to PCnB in zone B, not all PCs in zone B. Is it possible ? Thank you very much. ... View more

On the picture of second problem, I have to configure "any" on your strikeout places, right ? If yes, I'm afraid that it will affect my environment because there're other servers in 10.0.23.0/24 zone. If no, I changed only source user to unknown, known-user in my security rules. That's not work. Here's logs: Thank you. ... View more

Here's my screenshot configuration except all policies. In captive portal policy, I have only 1 rule for testing. The 3 policies for cp testing are on top. They are at 2nd, 3rd, 4th rule in order of security rules. Below them, there're many rules that allow traffic from other zones to 10.0.23.0/24 zone. Thank you very much. ... View more

I tested it using web-browser, I didn't see it redirected to another webpage when I was connecting to 10.0.23.85. In my case, I want to authorize internal staffs, only authenticated staffs can vnc to 10.0.23.85. Logs on "rule1" are denied vnc traffic from 10.0.113.79 to 10.0.23.85. When I disable "rule1", I can normally vnc to 10.0.23.85 because there's another rule below that allow vnc traffic. A strange thing is there is no log on "Allow_CP" rule although I've opened http://10.0.23.85 , that http logs appear on another allowed rule which below "Allow_CP" rule. I don't know how to open CP portal webpage. When I use web-browser to open the IP address of source interface, it returns connection timeout. ... View more

I checked Interface Management, it enabled Response Page on Source Interface. I changed to Redirect mode and added a security rule above allow users connect to CP portal but that's not work. The result is still "No rule matched" when using CLI testing. ... View more

Thank you. I don't know where to enable response page on source interface. I've just enable on 2 place: 1. Network => Zones => I checked enable UI on all zones. 2. Device => UI => Captive Portal Settings => enabled with transparent mode. Here's my security policies: ... View more

And another strange thing is when I type CLI "test cp-policy-match from ?" or "test cp-policy-match to ?", it only lists zones on only 1 virtual system. My system is in live production, inter-virtual system traffic are normal. I've just create a captive portal policy locally on 1 virtual system, test result is "No rule matched" too. ... View more

Thank you, VinceM. I checked several times, I confirm it's correct. I attach the rule, my laptop is 10.0.113.79, destination PC is 10.0.23.85. ... View more