About ksalustro

Fyi, I found this:   Q. How do I access the BPA+? A. There are two different ways to access the Best Practice Assessment Plus.   Customer Support Portal  login to your account and click tools, then Best Practice Assessment to generate an assessment of your current configuration.  Upload a tech support file to check for failed BPA checks. After the file is analyzed, the BPA report will be generated with the results. Once you open your report, please click “ Try BPA+ ” tab to launch BPA+ wizard.   You can also access  BPA+  from the  Get Help  location of the Customer Support Portal. Click the Get Help button and when entering the problem description, the system will determine you may be having a configuration issue based on your problem category choice. A “Launch BPA+” button will appear in the recommended solutions.   I opened my report file "Best Practice Assessment - Strata - ....html" and I had to click on something with a violation. Such as "Best Practice Assessment" then "Security Rulebase Checks" on the left.  You should see the button"Try BPA+" on the page.  HTH. ... View more

# debug software restart process management-server ... View more

Fabiano's suggestions did not work for me since I was already not using auth cookies. By default, the user's tunnel will be renamed and they will stay on the same gateway. But, perhaps you have a windows user group and you want them to get directed to a 2nd gateway. If you do refresh connection, they will switch, but you want it to happen automatically.   So, consider setting this timeout value for the pre-logon tunnel, under App settings, to 0:   Pre-Logon Tunnel Rename Timeout (sec) (Windows Only)   This setting controls how GlobalProtect handles the pre-logon tunnel that connects an endpoint to the gateway. A value of -1 means the pre-logon tunnel does not time out after a user logs on to the endpoint; GlobalProtect renames the tunnel to reassign it to the user. However, the tunnel persists even if the renaming fails or if the user does not log in to the GlobalProtect gateway. A value of 0 means when the user logs on to the endpoint, GlobalProtect immediately terminates the pre-logon tunnel instead of renaming it. In this case, GlobalProtect initiates a new tunnel for the user instead of allowing the user to connect over the pre-logon tunnel. Typically, this setting is most useful when you set the Connect Method to Pre-logon then On-demand, which forces the user to manually initiate the connection after the initial logon. ... View more

@brianjreed thanks for finding that setting. I have 2 gateways... pre-logon users all go to gateway A. Post-login, default users stay on gateway A but a certain user group needs to connect to gateway B. The trouble is that the user group was staying on A instead of switching to B. So hopefully this timeout will fix my issue. ... View more

We had an issue where anti-spoofing was blocking traffic, and there was nothing about it in the threat logs. ... View more

Just fyi, I have this working in an Azure environment, with a private IP on the virtual firewall in Azure, and didn't run into this problem... SAML works fine to Azure. ... View more

'vsys1' is supposed to show up as an option. Did you try to type in `vsys1` manually to see if it lets you? ... View more