About pandragon

As far as I remember, we can't run GlobalProtect and NetConnect concurrently on same PA unit. But a PC can have both clients installed concurrently and either of them can connect to different PA units running either GP or NetConnect. ... View more

You can create one rule (which needs to be identical on all devices) in Panorama for such situations. For example if you want a rule that says allow traffic from source named ServerABC which has different IP at firewallA, FirewallB, FirewallC. Create 3 different address objects in Panorama like ServerA with IP_Addr_A, ServerB with IP_Addr_B and so on. Then create an address group in Panorama like ServerABC that has members like ServerA, ServerB and so on. Presuming that network subnets under each firewalls are different and firewallA handles traffic from ServerA only (and so on for firewallB and FirewallC), such a workaround would serve the purpose. ... View more

Tried "Check Now" under Dynamic updates and it did not gave any error. system log also did not show any recent error for brightcloud. ... View more

One workaround would be use a separate web server to buy a wildcard certificate from Commercial CA with something like  *.yourdomain.com. Then export the certificate and private key file in PKCS or PEM format from that web server to PaloAlto firewall or Panorama. I think it may not be possible to generate CSR (Certificate Signing Request) from a PaloAlto firewall as I could not see any option to do that. Then the workaround like above helped. ... View more

You can try creating custom report under Monitor Tab - Manage Custom Reports. Then use Query Builder for query something like application not equal to dns. ... View more

It may be due to some Internet connectivity issue at your site. I checked using CLI command from one of the PaloAlto firewall as follows. request url-filtering download status vendor brightcloud And it shows result as follows. Nov 12 01:02:29 URL filtering database version 3979 is already the latest version ... View more

We had a PA-2050 on software 4.1.1 for a few days and there was no slowness during commits. Anyway, 4.1.2 is now released so upgrading to 4.1.2 might help. I did not encounter any issue during 4.1.2 upgrade just now. ... View more

I think if user is not found by PA device in the group-name seen under "Allow List" then the system log will show "Authentication Failed: Invalid Username or Password". That may be misleading.If you set filter when viewing logs, as eventtype=GlobalProtect, then you might miss other log where eventtype=general. If you do not set any filter, does the log also show event=auth-fail and description like "user xyz failed authentication. Reason: User is not in allowlist"? It may be something like attached screen sample. ... View more

"Revert to Running Configuration" will help as you mentioned to discard current changes. Load named config will be applicable only if you have saved a named config or you want to revert to an older named config that you saved. ... View more

During initial debugging, you may want to set "Update Interval" for "Group Mapping Settings" seen under "Device" tab - "User Identification". Click on the group mapping name and set "Update Interval" to something like 60 seconds (valid range is 60 to 86400 seconds). Then connect to the firewall using CLI via SSH client. Few useful CLI commands can be tried as follows: show user group-mapping state all show user group-mapping statistics In the output of above commands, check that "Number of Groups" is not zero. If it is zero, verify that you are not using * as wildcard under "Search Filter" field in Group Mapping configuration. For example, if you are searching for a group starting with words vpn do not enter search filter like "vpn*" but just enter "vpn". Once the group mapping starts showing results, you can revert "Update Interval" to somewhat longer instaed of 60 seconds. Hope this helps. ... View more