About ice-quake

Upgrade to 9.1.13-h1 resolved the issue. ... View more

This procedure doesn't work for me for some reason. What's interesting is the GP client displays the "connection failed, no network connectivity message" after the .dat files are deleted and the device rebooted, but the agent still establishes a GP connection/tunnel.  Seems buggy.  GP version 5.2.4 and 5.2.7. ... View more

Turns out you can't modify the existing gateway config to use the "Client IP Pool" - i.e. if you already have a config for  Agent\Client Settings\IP Pools you'll need to create a new gateway in order to use the "global" client IP pool.  This needs to be configured first and then the "Client Settings." ... View more

When I attempt to clear the  Agent\Client Settings\IP Pools the dialog box won't let me save (hit OK) and the message is "require at least on entry." ... View more

I have tunnel mode enabled and a tunnel interface assigned, but the option is still greyed out.  Also, under Client Settings > Config > IP Pools it requires an IP pool or else the config can't be saved.  Am I missing something? ... View more

Not sure if they've earned the "worst" title yet, but Palo TAC is pretty bad on average.  Of course they have qualified techs, but it's pretty hit or miss across products/features.  ... View more

Hi,   Is this feature recommended as a troubleshooting/debug tool only, or is it safe to enable during "normal" operation?  Depends on the environment?  ... View more

I experienced the same behavior on 9.1.  Is it a bug or did the default behavior change?  May be worth a TAC case. ... View more

The "dns-signature cloud service connection refused" is related to the DNS Security feature.  You'll need to allow your firewall management interfaces to connect to Palo's update servers - use the "paloalto-dns-security" App ID in firewall policy (assuming the mgmt. interface outbound traffic will transverse a Palo Alto firewall).  This may cause issues with DNS resolution if not resolved - depends on your policy/anti-spyware profile settings.  I'm not able to make any recommendation regarding your VPN issue without more details.  GlobalProtect?  Site to site?  Generic VPN through the firewall?   https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/threat-prevention/dns-security/enable-dns-security.html   ... View more

Not exactly what I'm looking for.  I like to find out exactly when an AppID was released without searching through individual release notes.   Would be nice if applipedia lists a "release date" for each AppID.    ... View more

Where can I find a running list/history of new App-IDs?  For example - the list of new AppIDs for 8/2020 (if any).  Would be nice if applipedia lists a "release date."  ... View more

I have GP agents experiencing the same issue.  Did you find a resolution? ... View more

(4/4/2020) Beginning with Applications and Threats content release version 8252, the dynamic configuration for System Tray Notification in the GlobalProtect app is removed (this option was deprecated starting in GlobalProtect app 4.1). You should expect to see a commit warning message ("GlobalProtect App Dynamic Configuration misses information for 'show-system-tray-notifications'") after you update to this or a later content release version. To permanently dismiss this warning message when it first appears, run the following CLI command in configuration mode: delete global-protect global-protect-portal "<portal name>" client-config configs "<agent-config-name>" gp-app-config config show-system-tray-notifications   ... View more

After I toggle "integrations" the # of indicators drops to 618 from 654, but still includes youtube.com and itunes.com etc.  What is the logic used to exclude 3rd party integrations?   I think I'm going to create some new nodes to match the "required" note in the category field.   https://docs.microsoft.com/en-us/office365/enterprise/urls-and-ip-address-ranges?redirectSourcePath=%252farticle%252f8548a211-3fe7-47cb-abb1-355ea5aa88a2   Category : Shows whether the endpoint set is categorized as “Optimize”, “Allow”, or “Default”. You can read about these categories and guidance for management of them at  http://aka.ms/pnc . This column also lists which endpoint sets are required to have network connectivity. For endpoint sets which are not required to have network connectivity, we provide notes in this field to indicate what functionality would be missing if the endpoint set is blocked. If you are excluding an entire service area, the endpoint sets listed as required do not require connectivity.   ... View more

I ran into the same issue.  Seems to be a design issue depending on your device group hierarchy.  In my case my firewalls are in a DG under an organizational DG.  For example shared > datacenter firewalls > data center A.  The issue is that I am managing security policy in the " datacenter firewalls" DG, which doesn't have any devices assigned to it - this is the issue.   But I'm not able to create an EDL in the "datacenter firewalls" DG and reference a cert file from the template.  I hope Palo dev fixes this.   ... View more