I am struggling with utilizing ActiveDirectory groups in firewall policy. My concern is then our AD administrators have control over transversing our firewall policy. Generally speaking say for example we have a FW policy setup where AD group ServerAdmins has <some type of> to a resource, they (the AD administrator) could very easily throw any user into that group thus giving sed person access to the resource. However I do love the user-ID capabilities and want to leverage that but it gets tideous having individiaul users defined in policy.   So my thought\question is if I could have a locally defined PA group (that I administrator) this would allow me to add the ActiveDirectory defined users into this group and then use this group in FW policy. Now I'm getting the benefits of user-ID and efficiency of using groups in firewall policy.   Curious if this is at all possible or if anyone else has any other options\ideas? ... View more

I have an odd issue where when I get the prompt from Global Protect saying "You have attempted to access a protected resource please click the link to authenticate" I am brought to the basic (not pretty) looking Captive Portal web-form login page and not the nice\fancy MFA login page. Does anyone have any ideas on this? ... View more

I have my MFA (using Duo) sort of working with non-browser based applications. However I am experiencing an issue that is an identical result whether I use SSH (putty) or RDP (remote desktop). Basically I am timing out because I cannot get through the Palo Alto authentication portal and then waiting for the push notification to the Duo agent on my cell phone in time for me to authenticate. Has anyone else experienced this and or have any advise as far as how to resolve?   ... View more

Curious if anyone is successfully using the commvault application within their Palo Alto application policies? We tried it and it is not working at all to detect our CommVault application traffic. The details on the application itself seem quite old. ... View more