About rjdahav163

Hi all, Our developers are connecting from Zone1 to Zone2 with tcp (on ports between 2000 and 3000) The tcp session timeout on firewall is 3 hours. The security policy allows any application, any port from Zone1 to Zone2. But there are all default security profiles applied on that rule. When going to Zone2, the source IP is NATted to the firewall interface IP of Zone2. Still the sessions end with reason "aged-out" after 1 hour when there is no activity. If we bypass the firewall, this behaviour is not observed. All other devices with and without firewall bypass are the same. Hence the suspicion on firewall. Any idea what could be the reason or what parameters I can check? Thanks! ... View more

Hi everyone,   We have our PA Firewalls in different countries all around the globe. Lets call them Country1, Country2. Country3 and so on. All locations are connected to each other via S2S VPN. We have Panorama in location Country1. And it manages firewalls in all countries over the S2S VPN. At all sites, we do have local admin accounts. Now, my concern is: Lets say if IPSec tunnel goes down between Country1 (Panorama Location) and Country5 then we lose firewall management completely. So what I do is that every country location has Global Protect configured. So if S2S tunnel is down, then I login to GP and login with local admin account. But the local admin account can modify only few settings where there is "override" option. I cannot completely manage the firewall in that case. I cannot edit policies with local account. So is this the right way to go about it? Is there any better way? Thanks!   ... View more