About rjdahav163

Hi everyone, We are using PAN OS 9.1.5. Our internal hosts and DNS server are in different PA Zones. We have a policy to allow all hosts to access DNS servers with application "dns". We used strict anti spyware profile on the above mentioned security policy. After applying anti-spyware profile, we see that the DNS queries timeout most of the times and very rarely when they work, the queries will take a long time. As soon as we remove the Anti Spyware profile, everything woks normally.  I am totally lost and cant find the root cause. Since there are no logs as well!! Is this any known issue? Does anyone else have similar problem? Thanks! ... View more

Hi Guys,   Our company has recently made several acquisitions. All of them have non-palo alto firewalls. We will be migrating each of non-palo firewalls to our palos. Now, for migrating the rules, we are using expedition.  But, some of them have overlapping IP addressing. We are planning to resolve that problem with NAT. But wanted to ask here: Is there any best practice documentation from Palo on how to handle mergers and acquisitions? Would be helpful. Thanks! ... View more

Hi Guys,   We are setting up a office and PA firewall is used as the internet gateway. The employees will mostly browse the web and use meeting applications like MS Teams etc. We want to have a generic outbound security policy for the employees for access to internet. We would like to have that rule application based (IF POSSIBLE) So I tried adding "web-browsing" and "ssl" in the rule but that was not sufficient. Many things got blocked. So I switched to Port 80 and 443 and most of the things are looking better. However, is there a best practice for a default outbound rule with several applications? Else, I'll need to allow everything and then based on logs add certain applications and ports. NOTE: I have implemented URL Filtering and other security profiles to that security rule. I am only concerned about what applications and/or ports should be used in this default outbound rule as matching criteria. Thanks! ... View more

Hi Folks,   We have following scenario and unsure how to do it. Please let me know your thoughts:   We have VM Palo Alto and we are implementing Global Protect. The Global Protect Portal and Gateway would be one and the same VM. We are planning to only have only one VPN link/URL which will be given to our customers. Now, we are planning to create all the users who will access Global Protect VPN to be created as users in PA Local User Database. Now, Customer A has employees a1,a2,a3.. who will access VPN Customer B has employees b1,b2,... Customer C has employees c1,c2,c3... and so on as need grows.   Now, Customer A employees can access only 10.1.1.0/24 from our internal network Customer B employees can access only 10.1.2.0/24 from our internal network Customer C employees can access only 10.1.3.0/24 from our internal network   How can this be done?   1. Do I need different IP pools per customer? 2. Can users be assigned static IP addresses when they connect to VPN? i.e. each time same address? 3. How can I bind users to customers? Or I dont need to do this?   I think I can do this somewhere in Gateway Config under client settings probably. But need your guidance here.  Any pointers appreciated. Thanks!   ... View more

Hi Guys,   We have global protect deployed. Portal and Gateway are the same firewall.  Now if I do any changes on the Gateway, are those changes immediately effective for the connected users as well? Is there any "profile" that is being pushed to clients/GP agent and if yes, when is it pushed?  Are the changes immediately synced?   Thanks! ... View more

HI Guys,   We have implemented Azure SAML authentication for global protect users. There is no group filtering on Azure site.  We tried limiting ldap groups in the: 1. SAML Auth profile on palo alto 2. Gateway > Agent > Client Settings   Inspite of the restrictions anyone outside the groups is able to connect to global protect. So does the groups setting on Azure override the group filtering on palo alto?   Thanks! ... View more

Hi Guys, We have PAN VM 300. To implement Zone Protection, we want to measure CPS. Now we dont have Panorama and dont do firewall monitoring with any tool. Now the admin guide suggests that: Use third-party tools such as Wireshark or NetFlow to collect and analyze network traffic. Use scripts to automate CPS information collection and continuous monitoring, and to mine information from the logs. These statements are a bit vague and there are no further steps / description.   Has anyone done this? Is there any further information / steps which can help me measure CPS efficiently?   Thanks! ... View more