About rjdahav163

Hi all, Our developers are connecting from Zone1 to Zone2 with tcp (on ports between 2000 and 3000) The tcp session timeout on firewall is 3 hours. The security policy allows any application, any port from Zone1 to Zone2. But there are all default security profiles applied on that rule. When going to Zone2, the source IP is NATted to the firewall interface IP of Zone2. Still the sessions end with reason "aged-out" after 1 hour when there is no activity. If we bypass the firewall, this behaviour is not observed. All other devices with and without firewall bypass are the same. Hence the suspicion on firewall. Any idea what could be the reason or what parameters I can check? Thanks! ... View more

Hi everyone,   We have our PA Firewalls in different countries all around the globe. Lets call them Country1, Country2. Country3 and so on. All locations are connected to each other via S2S VPN. We have Panorama in location Country1. And it manages firewalls in all countries over the S2S VPN. At all sites, we do have local admin accounts. Now, my concern is: Lets say if IPSec tunnel goes down between Country1 (Panorama Location) and Country5 then we lose firewall management completely. So what I do is that every country location has Global Protect configured. So if S2S tunnel is down, then I login to GP and login with local admin account. But the local admin account can modify only few settings where there is "override" option. I cannot completely manage the firewall in that case. I cannot edit policies with local account. So is this the right way to go about it? Is there any better way? Thanks!   ... View more

Hi everyone, We are using PAN OS 9.1.5. Our internal hosts and DNS server are in different PA Zones. We have a policy to allow all hosts to access DNS servers with application "dns". We used strict anti spyware profile on the above mentioned security policy. After applying anti-spyware profile, we see that the DNS queries timeout most of the times and very rarely when they work, the queries will take a long time. As soon as we remove the Anti Spyware profile, everything woks normally.  I am totally lost and cant find the root cause. Since there are no logs as well!! Is this any known issue? Does anyone else have similar problem? Thanks! ... View more

Hi Guys,   Our company has recently made several acquisitions. All of them have non-palo alto firewalls. We will be migrating each of non-palo firewalls to our palos. Now, for migrating the rules, we are using expedition.  But, some of them have overlapping IP addressing. We are planning to resolve that problem with NAT. But wanted to ask here: Is there any best practice documentation from Palo on how to handle mergers and acquisitions? Would be helpful. Thanks! ... View more

Hi Guys,   We are setting up a office and PA firewall is used as the internet gateway. The employees will mostly browse the web and use meeting applications like MS Teams etc. We want to have a generic outbound security policy for the employees for access to internet. We would like to have that rule application based (IF POSSIBLE) So I tried adding "web-browsing" and "ssl" in the rule but that was not sufficient. Many things got blocked. So I switched to Port 80 and 443 and most of the things are looking better. However, is there a best practice for a default outbound rule with several applications? Else, I'll need to allow everything and then based on logs add certain applications and ports. NOTE: I have implemented URL Filtering and other security profiles to that security rule. I am only concerned about what applications and/or ports should be used in this default outbound rule as matching criteria. Thanks! ... View more

Hi Folks,   We have following scenario and unsure how to do it. Please let me know your thoughts:   We have VM Palo Alto and we are implementing Global Protect. The Global Protect Portal and Gateway would be one and the same VM. We are planning to only have only one VPN link/URL which will be given to our customers. Now, we are planning to create all the users who will access Global Protect VPN to be created as users in PA Local User Database. Now, Customer A has employees a1,a2,a3.. who will access VPN Customer B has employees b1,b2,... Customer C has employees c1,c2,c3... and so on as need grows.   Now, Customer A employees can access only 10.1.1.0/24 from our internal network Customer B employees can access only 10.1.2.0/24 from our internal network Customer C employees can access only 10.1.3.0/24 from our internal network   How can this be done?   1. Do I need different IP pools per customer? 2. Can users be assigned static IP addresses when they connect to VPN? i.e. each time same address? 3. How can I bind users to customers? Or I dont need to do this?   I think I can do this somewhere in Gateway Config under client settings probably. But need your guidance here.  Any pointers appreciated. Thanks!   ... View more

Hi Guys,   We have global protect deployed. Portal and Gateway are the same firewall.  Now if I do any changes on the Gateway, are those changes immediately effective for the connected users as well? Is there any "profile" that is being pushed to clients/GP agent and if yes, when is it pushed?  Are the changes immediately synced?   Thanks! ... View more

HI Guys,   We have implemented Azure SAML authentication for global protect users. There is no group filtering on Azure site.  We tried limiting ldap groups in the: 1. SAML Auth profile on palo alto 2. Gateway > Agent > Client Settings   Inspite of the restrictions anyone outside the groups is able to connect to global protect. So does the groups setting on Azure override the group filtering on palo alto?   Thanks! ... View more