About nbctcp

@nbctcp   For the IPSec VPN configuration about Sangfor, I find an introduction video on their official YouTube Channel.  https://youtu.be/hy7UxfpzPGg Hope this one will be helpful.  From my experience, most of the time, we just need to clear the set of options we gonna use(IKE setting, subnet etc.) and follow the guidance of configuration, it will do the job. ... View more

By definition, unless you decrypt outbound traffic, no firewall would be able to tell DNS over HTTPs traffic from the rest, especially if DoH is implemented over a large cloud infrastructure that you can't block with IP lists (think about Cloudflare and Google, which might host the service on their "base image" and mix up services at their will). I think the only currently viable solution is browser makers honoring some "kill switch" mechanism (e.g. Mozilla's canary domain: https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet and network administrators implementing it, where appropriate (I'm thinking about networks where you have a split-DNS situation, and external clients are pointed to a different IP than internal ones... ...lots of reasons to do this, and not all of them can be worked around). Anyway, not really a firewall problem/solution, here, unless we start fiddling with PAN's DNS proxy. ... View more

I agree with @BPry , use URL filtering and AD groups for this. I do it all the time. ... View more

The PA has to be license and activated as the overall box.  Then under the URL filtering if you have never used or licensed that feature you can activate a 30 day demo.  You need to have the base activation done and the period still active.   If you have already used and expired a URL license then no more demo is available.   If no activate of the device has happened at all or the initial period has expired, then there are no demo options. ... View more