About LukeBullimore

Hey @JimMcGrady ,   When doing a firewall failover, how long are you waiting between checking interface IPs? The reason for this is because using the Plugin for failover can take a few minutes. The recommended method to deploy VM series for high-availability in Azure is with two VM series deployed into two availability sets that sit in a load balancer sandwich.   Thanks, Luke. ... View more

Hi All,   It is possible to drop packets with the timestamp option set through a Zone Protection profile.   Network -> Zone Protection -> Packet Based Attack Protection -> IP Drop -> Timestamp.   The zone protection profile would then be applied to the ingress zone, untrust.   Cheers, Luke. ... View more

Looking at the metrics, both firewalls are showing as 100% healthy.   The traffic is now coming from outside -> into the load balancer -> into the firewall -> we are sending it from the firewall to the test web server but if we do a pcap on the test web server, it doesn't see anything. ... View more

Hey @jmeurer    Didn't originally since I thought no NSG meant allow all. I've applied an allow-all one to the untrust interface now and I'm seeing traffic thats hitting the palos untrust public IP. but not the public ip of the load balancer, any ideas? ... View more

Hey @Pattarachai    This is totally possible! I'd recommend checking out the documentation below. https://docs.paloaltonetworks.com/panorama/8-1/panorama-admin/manage-firewalls/transition-a-firewall-to-panorama-management/migrate-a-firewall-to-panorama-management.html ... View more

Hey @anthonyx10networks    Main question to ask is what their throughput requirements are. Looks like with everything turned on the WatchGuard does 8Gbp/s -so the direct comparison would the PA-5220.   https://www.paloaltonetworks.com/resources/datasheets/product-summary-specsheet ... View more

Hey @LeeRRoss    In addition to readers comments, you may also want to check out the below documentation.   https://docs.paloaltonetworks.com/panorama/8-1/panorama-admin/manage-firewalls/transition-a-firewall-to-panorama-management/migrate-a-firewall-to-panorama-management   It kinda makes sense that, if you already have a configuration on the firewall, then try pushing configuration from Panorama - it will fail since the configuration already exists. That's why Panorama has an option for "Push device config bundle" (step 5) which helps avoid any commit errors.   Give that a go and let us know if that works.   Cheers, Luke. ... View more

Hey @LCMember4427    Glad I could provide some insight for you!   Now you're asking the real questions... GlobalProtect doesn't really have an "On-Off" switch... but thinking about it, if you're going to be using GlobalProtect internally, the traffic won't be tunnelled so why would you want to turn it off? One option I can think of on the top of my head is have the connect method by default set to On-Demand User Login (a user can disconnect or connect at will) but then during exam times the connect method is Always-On, so as soon as the PC boots up it will make the connection attempt.   " If yes, does it exist an elegant way to tell them 'Please use your GP client today'...  ?" apologies to disappoint on this one. But I don't think so. I'll leave that question in the air for someone else in the community to answer though.   "Does it exist a white paper or something which explains the settings to be done in a GP scenario like that?"   You'll want to go for an 'Internal Gateway' deployment   https://docs.paloaltonetworks.com/globalprotect/8-0/globalprotect-admin/globalprotect-gateways/globalprotect-gateway-concepts/types-of-gateways   https://docs.paloaltonetworks.com/globalprotect/8-1/globalprotect-admin/globalprotect-quick-configs/mixed-internal-and-external-gateway-configuration   Cheers, Luke.   ... View more

Hey @LCMember4427    If you're mentioning that the users are coming up as unknown, it means that they don't have any mapping tied to them as you mention. Hence, clearing user-to-ip mappings shouldn't make any difference.   I'd like to comment on two points you raised:   However I thought that any http or https request issued after CP had been switched on would trigger the CP auth dialog to pop up, but apparently this is not the case.   This is actually incorrect (as you sort of alluded to) - the firewall can only serve a captive portal session on HTTP sessions. This is expected behaviour and essentially the purpose of SSL was to stop against man-in-the-middle attacks, which essentially you can consider a captive portal to be one.  The only way the firewall will be able to serve captive portal sessions over SSL is if the firewall is doing SSL decryption. But since you mentioned these machines aren't domain joined - that option really isn't feasible.   You mention that this was working eight years ago - I simply believe this to be because the number of SSL sites has increased since then - resulting in an increasingly less amount of opportunity for the captive portal to be triggered. Likely 8 years ago, the home pages of the machines were set to a site that was listening on HTTP -so when the machine booted up and tried contacting that site the firewall could do its captive portal.   Other than decryption, you might want to look at deploying GlobalProtect as a method of obtaining user mappings for these machines.   Cheers, Luke.     ... View more

Hey @RobinClayton @Abdul_Razaq  We've had the same issue before; after logging it with TAC it seems that long-lived SIP sessions will die after going through six content updates. We worked with TAC for a long time and the fix is in PAN-OS 8.0.13 ( PAN-97253). So give that a shot.   FYI current preferred 8.0.x release is 8.0.16   Cheers, Luke. ... View more

Hi Mick,   Just tried with no intermediate; same result.   I'm importing it as a PKCS12 yep. ... View more