About Brandon_Wertz

@BPry wrote: @olloczky, No. Detailed logs are only kept on the client side, and the firewall won't be able to tell you why a client was disconnected unless it was disconnected by the firewall itself.  While not wrong, the most detailed logs would come from the remote client, a firewall running PAN-OS 9.1.X does have greater logging than previous code versions.  There are "Global Protect" logs in the monitor tab which might help identify why a user is getting disconnected or not connecting. ... View more

@FWPalolearner wrote: Hello @Brandon_Wertz .thanks.   Wired and wireless are separate currently because of historical reasons . Customer goal is to have single zone for corp users no matter from where they are coming wired wireless or through GP.   I fully agree that having a separate zone for gp makes it more granular but that's the customer requirements.   So you mean it is doable to have all in same zone I mean vlan subinterfaces plus loopback/ tunnel interface?     Yes, there's not a technical limitation for having all be in the same zone, as long as the interface type match the zone.  For instance L3 zone, but L2 Interface type.  (I'm fairly certain they need to match.  I know you can't have a vwire interface in a L3 zone.) ... View more

@FWPalolearner wrote: Hello ,   We have currently three diffent zones defined .   Zone A vlan 100. For wired users  Zone B vlan 200 for wireless users  Zone V tunnel/ loopback interface for Global protect users.   All the above users mentioned are corp users.   Now customer wants to create. single zone called "All users" and want to put vlan 100 200 and loopback/ tunnel into it.   Is it wise to use same zone for GP users ?   Is it doable ? What are the challenges of we have a single common zone for user traffic ( wired+wireless+gp users )                     In general a good security practice would be to keep remote / VPN users in a separate security zone.  There would be some mitigating factors for not doing so like an "always-on" VPN, but still to ensure the most visibility it would be better to keep VPN users in a separate zone.   It's very doable to have all in the same zone.  You just need to weigh the various components of the reasons for keeping them separate.  Functionally what's the benefit to have wired and wireless users that are internal in a separate zone?  Are they a different user or business function?  Personally I don't see the need to break out "on-prem" users into different zone, but there might be a logical reason to do so.   For a VPN user there's more of a logical reason to keep those users/devices in a separate zone even if it's still a corporate owned device. ... View more