About jeff6strings

We have SAML for GlobalProtect setup and working on our test PA firewall and cannot be used for production. Our goal is to configure our production firewalls to use SAML for GlobalProtect and limit specific AD groups for testing until we make SAML global. I know SAML can't be used in an Authentication Sequence, and adding a Client Authentication config in the GP Portal Authentication>Client Authentication list won't help. Having read other posts, this list is not a failover, and the only criteria are OS.   Our current GP VPN configuration is the following: Firewall 1 (v8.1): Portal, which the domain name points to and is a Gateway, and all three firewalls (this and the two below) are in the External Gateway configuration. Firewall 2 (v8.1): Portal configuration but used as secondary & Gateway, and all three firewalls (this and the one above and below) are in the External Gateway configuration. Firewall 3 (v9.0): Gateway only and included in the External Gateway configuration in the two portals above.   I was thinking of configuring on Firewall 1 Portal, making the first two firewalls available to the existing GP AD group. Then, creating an Agent Configuration pointing to the AD SAML group and making Firewall 3 the SAML authentication firewall with only this firewall in this Agent Config. My obstacle is the GP Portal Config Authentication and the limitation of the Client Authentication list.   I appreciate any feedback, recommendations, or thoughts. Jeff   ... View more

In the Cisco ASA at the CLI there is a command to not display names but their IP addresses: no names. Is there a similar command in PAN-OS; I'm using v 8.1.13? My goal is to list/export NAT policies without names as the individuals who will review this will recognize IP addresses. Thanks for any help.   Jeff ... View more

I have a firewall (lab unit) with version 9.1 and I configured two Security Policy Rules. The top rule (1) is Trust to Untrust, a source user is a group, all default options, and an Action of Deny. The second rule (2) is Trust to Untrust, a source user is a group (different from above), all default options, and an Action of Allow.   When I commit the changes I receive a Rule Shadow warning stating rule 1 is shadowing rule 2. The commit succeeds but although both rules are the same, except for Deny and Allow, each is only different by the Source User and I would have thought it would know that. I assume this logic is not included in Shadow checks? Thanks for any insight.   Jeff ... View more

We have a 3020 firewall with version 8.0.10 and need to allow a new server access to resources in other zones. An existing server, 10.100.100.10 already has this access, so I need to mimic the access of this server.   In Objects\Addresses there is an entry for 10.100.100.10 with the name Server1. In Objects\Address Groups there are a couple of groups in which server name Server1 belongs.   In Policies\Security, when I search for Server1, four Security Policy Rules result. When I check them, all have Server1 in either Source or Destination.   When I search Policies\Security using the Server1 IP address, 10.100.100.10, a half dozen result, two of the results have Server1 name, but the other four don't. I checked these four, and they don't have the server name or IP address anywhere in the rule.   I appreciate any help in understanding the logic of how the other four policies result by IP address. Thank you. Jeff     ... View more

We have Palo Alto firewalls with version 8.0 and need to allow SQL Cluster synchronization from one zone to another. The servers are Windows 2016 with MS SQL 2016. I'm not a SQL expert but tasked with a firewall rule between these clusters. I appreciate any advice or help.   Jeff ... View more