About Jake.Ryan

hello   I am testing our rollout of mobile user vpn with pre-logon and always on currently we are on-prem with on-demand so its complete change in user experience   but with one of out test users we found today when they are at home using they are using a device that displays company wifi so they connect to this and they are detected as internal which is good this use then comes to the office (most likely just closing the laptop lid) and docks their laptop so this moves to cable - when this happens the internet detect fails - the DNS query is successful but it seems to still connect to the portal and then the user is treated as if they are external and receive their MFA logon   if they refresh connection it then changes to internal - yes this is a repair but not something I can share out to 4000+ users as a workaround without negative feedback   I caught the end of a forum post which said:  FYI. be aware that if you are testing by switching from wifi to LAN then internal detection will not work and you will need to refresh the GP client manually for this to happen.   is this something fixed in another release compared to GP version 5.1.8? ... View more

Hello,   I am sure I tested this previously and found it work but today when I am testing the routing seems to fail -  as a background my sites have Internet using Prisma Remote networks and also backend MPLS connectivity   layout example: I have all my Remote sites - with static advertisements 192.168.1.0/24 - Site A 192.168.2.0/24 - Site B 192.168.3.0/24 - Site C 192.168.4.0/24 - Site D   I have my data center with static advertisements - set at a Service connection  192.168.95.10/32 - Service Connection - Domain Controller 192.168.95.11/32 - Service Connection - Domain Controller 192.168.96.0/20 - Remote Network - User Browsing 192.168.0.0/16 - Overlapping Cover subnet (tried both Remote and Service Networks)   so when I am a mobile user I connect to Site A for resources - if the Internet or prisma Remote Network fails it should call back to the covering subnet in the datacenter as that static route is class as down if the tunnel monitor is also down?   I am sure months ago I tested this and it worked like a treat - but now I am testing with remote and service networks and it does not want to let the DC take over when the site remote network for Site A is down....I am sure this was working if it fails back to DC then I can use the backend MPLS to route this traffic until the remote network is up   any ideas         ... View more

Hello   hoping someone is having the same issue - it seems any app and threat update i complete from 8274-6098 18/05/2020 is causing nearly all my traffic to appear as unknown-tcp this stops my global protect portal, internet browsing traffic and NATd traffic via load balancers   i seem to get Start - Web-browsing - 443 Deny - unknown-tcp - 443 End - SSL - 443   i tried jumping straight to 8275-6101 but i have the same issues even if i disable new apps and contect   my stable version is currently 8273-6091 (16/05/2020) - anything newer everything starts with unknown-tcp events   any ideas or suggestions?   PA-3020 - PanOS 8.1.10   ... View more

Hello   I am trying to exclude some domain from coming through the gateway to improve user experience so they are not hair-pinning through our DC's   at the moment I have no access route entered so I am running 0.0.0.0/0 out of our DC's - there are are certain domains for Microsoft updates, teams and hosted business services   when I add them to exclude domain it seems to work correctly - for example if I add www.bbc.co.uk this will browse local as expected but all other websites are stop working I was hoping when I add excluded domains to browse local, what remains continues to hairpin via the DC;s   I have been trying to find a wildcard I could enter in the include domain to continue to get the internet working but this does not seems to work   are there some examples there people are using to I can see what I am doing wrong? I have been through the admin documents but maybe I am missing something is there something I an doing wrong here or am I expecting more than is possible? ... View more

Hello   we are trying to implement HIP checks for our users but we seem to be getting many clients not reporting AV installed we have the same clients in the same locations and other gateways all reporting correctly we have checked the non-compliant desktops directly and we can see the AV is there but not being detected in the host information   I was wondering is this was something to do with the data file versions between gateways - but what I am finding is even though I have set a schedule the files never seem to download I run the following: less mp-log avdata.log and the output which stands out is: <result>You do not have a global protect license</result> but all my firewalls are licences for portal and gateway and all running panOS 8.1.4   any suggestions? is there a way I can tell the difference somewhere? ... View more