About rjdahav163

Hi Folks,   We have following scenario and unsure how to do it. Please let me know your thoughts:   We have VM Palo Alto and we are implementing Global Protect. The Global Protect Portal and Gateway would be one and the same VM. We are planning to only have only one VPN link/URL which will be given to our customers. Now, we are planning to create all the users who will access Global Protect VPN to be created as users in PA Local User Database. Now, Customer A has employees a1,a2,a3.. who will access VPN Customer B has employees b1,b2,... Customer C has employees c1,c2,c3... and so on as need grows.   Now, Customer A employees can access only 10.1.1.0/24 from our internal network Customer B employees can access only 10.1.2.0/24 from our internal network Customer C employees can access only 10.1.3.0/24 from our internal network   How can this be done?   1. Do I need different IP pools per customer? 2. Can users be assigned static IP addresses when they connect to VPN? i.e. each time same address? 3. How can I bind users to customers? Or I dont need to do this?   I think I can do this somewhere in Gateway Config under client settings probably. But need your guidance here.  Any pointers appreciated. Thanks!   ... View more

Hi Guys,   We have global protect deployed. Portal and Gateway are the same firewall.  Now if I do any changes on the Gateway, are those changes immediately effective for the connected users as well? Is there any "profile" that is being pushed to clients/GP agent and if yes, when is it pushed?  Are the changes immediately synced?   Thanks! ... View more

HI Guys,   We have implemented Azure SAML authentication for global protect users. There is no group filtering on Azure site.  We tried limiting ldap groups in the: 1. SAML Auth profile on palo alto 2. Gateway > Agent > Client Settings   Inspite of the restrictions anyone outside the groups is able to connect to global protect. So does the groups setting on Azure override the group filtering on palo alto?   Thanks! ... View more

Hi Guys, We have PAN VM 300. To implement Zone Protection, we want to measure CPS. Now we dont have Panorama and dont do firewall monitoring with any tool. Now the admin guide suggests that: Use third-party tools such as Wireshark or NetFlow to collect and analyze network traffic. Use scripts to automate CPS information collection and continuous monitoring, and to mine information from the logs. These statements are a bit vague and there are no further steps / description.   Has anyone done this? Is there any further information / steps which can help me measure CPS efficiently?   Thanks! ... View more

We unfortunately use a smtp server with fqdn. (cannot use fqdn object for certain reasons) And we implemented a security policy with the url category in the "Service/URL Category" section of the security policy. In the security policy, the application allowed is smtp and port allowed is 25. When we test, the connection does not match this rule at all. We are making sure that indeed the application tirggered is smtp on port 25.   So is URL Category in Security Policy only applied when the application is web-browsing/ssl and port is 80/443 ?   BR, RJ     ... View more

Hello   we are planning to migrate from PAN OS 7.1 to 8.1. Is there a document or a list of tests that we can do to check if the migration was successful ?  I mean we can obviously test if some critical servers are reachable but still any template would help here.   Thanks and Regards, RJ ... View more

Hi   I have a captive portal login page. After the users authenticate, how to display a customized "Login Successful" page ?   BR, RJ ... View more

Hi   We have a server, from where the user wants to go to, for example, abc.xyz.com. The certificate from the website xyz.com has a CN *.xyz.com.   We dont have decryption for URL Filtering. In the URL Filtering category, we have allowed  abc.xyz.com. The user on the server wants to use an application which initiates a connection to abc.xyz.com. Now, When the user opens a browser and goes to  abc.xyz.com, then the connection is allowed as the firewall sees the URL as abc.xyz.com.  When the user uses his application, the the firewall sees the request to *.xyz.com and blocks it.  If we allow *.xyz.com then the application works.   Anyone have same experience? Any workaround without decryption?   BR, RJ ... View more

Hi   We have Panorama managing 6 PA FWs (3 HA Clusters). We want to change the management net of Panorama and Firewalls. Now logically we will change management IP of Panorama first. Then the Firewalls will lose connectivity and probably logs will be lost.   So is there any best practice guide for this process? What all should be taken into consideration while doing this change?   BR, RJ   ... View more

Hello everyone,   the users in our company use Google Hangouts / Meet. We allowed google-hangouts and google-meet and all the dependent applications with Service Any. However the connection is recognized as ms-lync!!   Anyone else facing similar issue?   Best Regards, RJ ... View more