About ice-quake

The "dns-signature cloud service connection refused" is related to the DNS Security feature.  You'll need to allow your firewall management interfaces to connect to Palo's update servers - use the "paloalto-dns-security" App ID in firewall policy (assuming the mgmt. interface outbound traffic will transverse a Palo Alto firewall).  This may cause issues with DNS resolution if not resolved - depends on your policy/anti-spyware profile settings.  I'm not able to make any recommendation regarding your VPN issue without more details.  GlobalProtect?  Site to site?  Generic VPN through the firewall?   https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/threat-prevention/dns-security/enable-dns-security.html   ... View more

@ice-quake  I think I see what you mean.    The way to get that to happen is to put in a Feature Request with an SE (Sales Engineer) as they are the ones that put in these requests to the developers.  ... View more

I have GP agents experiencing the same issue.  Did you find a resolution? ... View more

Hi @ice-quake, the nodes look for the word "integration" in the notes attribute of the URLs/IPs sections. This is far from optimal, but today there is no way to identify programmatically if a URLs/IPs in that list belongs to MSFT or not. The "required" field has a different meaning, not only includes 3rd party accessory sites but also optional MSFT sites. If you are ok with dropping *all* the optional sites, you can change the prototype of the Miner to drop all the indicators with o365_required attribute set to false. The O365 API Miners already expose that attribute in the indicators. ... View more

@Tician did you get this working? ... View more

@ice-quake, Yes. For example if I make an app called 'WSL-Slate', I'll need a security policy that actually allows my users to access this 'WSL-Slate' application.  ... View more