Correct. Unfortunately this ends up being on the Windows side. Apparently, there is no way to force windows to default to the GP option in the "Sign-in" options tile. ... View more

We cannot access to the LAN of the PA-500 .......... from where? Please add more details We cannot access to Internet using the PA-500............. again, access the Internet?  I guess you mean from the LAN, but using which ISP? I believe you might be running into some asymmetric routing issue because of the different ISPs that you have configured. I could suggest segregating them by using different virtual routers, but you need to make sure you have the proper routes in place in each of the VRs. ... View more

Suena a que lo mejor seria abrir un caso de soporte con el TAC, ya que es posible que se requiera reemplazar el equipo. ... View more

Do you see any core files? Check the output of: > show system files ... View more

"Cutoff time" specifies the amount of time (in seconds) the agent will wait for gateways to respond before determining the best gateway to connect to. The agent will then attempt to connect to only those gateways that responded within the specified Cutoff Time. The default value is 5. A value of 0 indicates that there is no cutoff time; the agent will wait until the TCP timeout ... View more

The cookie is used to provide cookie-based agent authentication. The value is used to specify the number of days that the agent can use the cookie to authenticate to the portal for a configuration refresh; a value of 0 (the default) indicates that the cookie never expires. This document shows an example and and explains more about this feature: GlobalProtect Prelogon Using Cookie Based Authentication ... View more

Can you provide details about what your PAN-OS version and GP versions are? Also make sure that the gateways configured are specified by IP address. Could you also let me know what is the configured Cutoff time on the Gateways configuration (Network > GlobalProtect > Portals > Client Configuration > Gateways)? I suggest you leave the default (5). ... View more

Just to add something that has not been mentioned... It could be possible that the traffic is indeed reaching the firewall and the NAT itself working properly, but you need to make sure you have a route not only on the firewall to reach the private IP, but also a route configured on the server itself to get back to the outside world through the same firewall interface that was used to forward the incoming packets. Hope this helps. ... View more

As Guillermo said, the application "Facebook-Video" will help you accomplish this. However, I just wanted to emphasize that you may need to implement decryption in this case since Facebook tends to go over SSL. Thanks, P ... View more

You can also log into your account and visit your Wildfire portal and get a report on the malware that has been detected in the traffic that was uploaded by your firewall. ... View more

If you are using the management interface for this connection, you can also do a tcpdump there to see what's going on. > tcpdump snaplen 65533 filter "xxxxxxxxxx" ... View more

Hello, Have you checked your service routes? Make sure you are using the right interface to fetch the server that contains the list. Also, if you are using a proxy server, make sure that your configuration is correct. Thanks. ... View more