About JimMcGrady

With Palo gateway appliances, is it possible to give the management interface a secondary IP? ... View more

When i set our URL filter to block category 'web advertisements' it works as expected. However, it also blocks many of the results of Google and Bing searches. I understand that is because the results in question are web advertisements, strictly speaking.   Ideally i'd like to block inline advertisements whilst allowing results from Google/Bing searches - even if they are web ads. If this isnt possible, how would i go about setting up exceptions for specific *.site.com URLs? ... View more

For the most part, Globalprotect is working fine. However, we have one web based app where users are reporting session disconnect errors after being idle for 5 minutes. When connecting to the corporate network rather than via GP, these users dont see the issue. Are there any TCP idle timeout settings specific to GP rather than for the firewall overall? ... View more

My client is running GP 5.0.8 clients to a 9.0.9 Palo Alto gateway.  Globalprotect doesn't seem to be using the fine granular password expiry details from AD. Its saying the password will expire in 6 days when it wont actually expire for many months.  Is there a setting i must change to have GP reference the correct source for password expiry in AD? ... View more

I have user mapping configured under user identification to monitor my AD servers - which are showing as 'connected'. My trust zone has user-id enabled. My globalprotect clients are in the trust zone. Their 'source user' correctly shows in the traffic log.  However none of the other networks in my trust zone list a source user in their log entries. Why might it be that one network (globalprotect) lists user-id in traffic but the other networks do not? ... View more

I have a pair of VM-300 in a load balancer sandwich configuration in Azure. An internal load balancer is on the inside and handles outbound traffic. An external load balancer is on the outside and is intended for inbound traffic from internet.  I can assign a public IP as the front end of the external load balancer. My first question - can a single external load balancer have multiple public IP front ends defined?   My second question concerns how traffic flows from an internet client to one of my backend servers. This is my understanding - please correct me if i am wrong:   The external interface of each of the two firewalls resides on a privately addressed subnet. Example: 10.1.1.0/24 with fw1 being 10.1.1.4 and fw2 being 10.1.1.5. Each firewall has a default route to internet via Azure gw ip 10.1.1.1   The frontend of the ELB has a publicIP 13.75.1.1 described as 'webserver1'. It has a backend pool called webserver1-pool. The real backend webserver is 10.2.2.10. But that is not directly reachable from the LB. And we want the traffic to route via the firewalls.   If i want the LB to forward traffic via the vm-300 pair, then the backend pool members would have to be addresses on subnet 10.1.1.0/24 yes? fw1 could have a secondary IP of 10.1.1.11 associated with its external interface. It would then have a nat rule such that traffic destined for 10.1.1.11 is destination natted to go to 10.2.2.10. Similarly, fw2 could have a secondary IP of 10.1.1.12 associated with its external interface. It would then have a nat rule such that traffic destined for 10.1.1.12 is destination natted to go to 10.2.2.10. Therefore the backend pool defined on the ELB would have members webserver1a 10.1.1.11 and webserver1b 10.1.1.12   Would each firewall also have to source NAT the traffic so the real server's replies path correctly? Or will that just work? Is there a cleaner way of doing this? having multiple NATs is a pain.  having to use the firewall's external interface subnet for all NATs is also awkward.   ... View more

I have a Panorama 9.0 managing various 9.0 firewalls.  If i generate a simple custom report of total send/receive bytes for the top 25 destination IPs, i find the results vary with time. For example, if i run the report for the previous 24 hours, and do this each day for a week, i can merge and sum the totals in Excel.  If i run the same custom report as a single job for the entire week, the figures vary considerably from the merged report.  This happens whether i use the summary traffic database or detailed database.   I have seen the same behaviour for top source IPs and top applications. The totals for bytes do not agree. ... View more

Can you form a HA cluster with a PA-3020 and PA-3060? Or do models have to be identical? ... View more

Is Panorama running 9.0.x able to manage a gateway running 9.1.x? ... View more

I'd like to setup a GP environment with a single portal, but two different locations (gateways?) where clients can connect. The documentation talks of gateways and satellites. I'm uncertain of the differences and when you would choose one or the other. Can someone clarify? Thanks. ... View more

Global protect has the handy feature of excluding select destinations from being sent over the vpn. For example, setting ( Split Tunnel -  Domain and Application -  Exclude Client Application Process Name ) https://docs.paloaltonetworks.com/globalprotect/4-1/globalprotect-app-new-features/new-features-released-in-gp-agent-4_1/split-tunnel-for-public-applications   Can this feature make use of Windows environment variables such as LOCALAPPDATA?  Some apps install in the user's path rather than in a user-independent path. . ... View more

The documentation seems a bit light on detail. I have created a Service Principle in Azure and entered the data into my two firewalls as per these documents: https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/set-up-the-vm-series-firewall-on-azure/configure-activepassive-ha-for-vm-series-firewall-on-azure https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal   The firewalls validate successfully. However, during failover, the secondary IP addresses dont move. Should there be some config on the firewalls to say "move secondary IP addresses of interfaces A, B, C, and move public IP"? Would there be corresponding config within Azure? How does the system know which interfaces need their addressing changed? ... View more

When a client uses a version (4.1.13) different to what is available from the gateway, they see a popup prompting them to upgrade/downgrade. How would I go about turning off this popup? ... View more

I'm looking at an old version 7 PA3000 which uses a user-id agent to map users (active directory) to IP addresses. When i log onto the firewall CLI  a "show user ip-user-mapping-mp all" command returns what looks to be a valid list of user mappings.  However 90% of the traffic log entries have 'source user' blank.  There doesnt seem to be a reason why the remaining 10% are displaying correctly. Some clients from a given subnet passing through a rule are identified and others arent.  Any troubleshooting suggestions would be appreciated. ... View more