About hpunjabi

Hi Bagus,   You wont be able to clone an http-proxy application, you will have to define a custom application: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/app-id/use-application-objects-in-policy/create-a-custom-application   I am pretty sure it is something to tweak with your security/decryption policies,try correlating logs when accessing directly and when going through squid proxy, check if facebook chat and other applications are getting identified.    If you can paste decryption policy and security policy for facebook then we can take a look. ... View more

Hi Nick,   Yes you should be able to configure VPN between GPCS Cloud and AWS VPN.   1. Create a Customer Gateway (Amazon) pointing to GPCS Cloud Public IP. 2. In VPN Connection (Amazon) specify static routes for Mobile VPN/Remote VPN subnet as well as Infrastructure subnet in GP cloud. 3. In GPCS all configuration should be same like other VPN, specify Amazon VPC as remote subnet and in tunnel monitor specify 169.X.X.X ip address specified by Amazon (this can be viewed once you click Download configuration).   Also one thing to take note that the encryption and authentication would be visible under downloaded configuration from Amazon which you will have to replicate in GPCS.   ... View more

Hi @hibagus,   Can you check which rule is it hitting while you are accessing through squid proxy is it the same rule created for squid proxy or different.   If the rule hitting is different than one thing which I can think of now is that you have 'application-default' enabled under service section in the squid policy, change that to 'any' and check if it is working after that.         ... View more

For Decryption you might need to look at your decryption policies first see if squid proxy (IP or port) is mentioned in decryption and see if it is working fine.   One simple way to check if decryption is working or not is to check certificate in your browser when working through squid are you getting certificate from firewall or from the server directly.   Also in the logs, if you see logs detail and in flags section check if you are able to see decrypt flag.   Below article can help you to troubleshoot decryption if it is not working:   https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Implement-and-Test-SSL-Decryption/ta-p/59719     ... View more

Ok, so is squid traffic hitting same policy as that of Direct traffic ?   Also can you try to configure a policy for below website and see if it works in both the scenarios, if it works then decryption might be one of the reason for it not working.   http://www.tinyupload.com/ ... View more

Hi @hibagus,   Does these rules involve user identification as well or are they simply on source and destination IP's.   What is the application getting identified in the rules which are working and non working ?     ... View more

Hi @GFN182,   You can follow below link:   https://www.paloaltonetworks.com/documentation/80/virtualization/virtualization/set-up-the-vm-series-firewall-on-aws   ... View more

Hi @nbenos,   You should be able to form VPN between AWS VPC and Global Protect Cloud.     Are you trying VPN connection with AWS VPN Gateway or do you have a VPN capable device (Palo Alto EC2 instance for example) in your VPC ? ... View more

Hi @ausafali88,   While generating the certificate do not tick the option as Certificate Authority then you should get the option of selecting Certificate for Secure syslog.   You can select signed by option from an already generated Internal CA certificate. ... View more

Yes usually as best practice it is recommended to use different certificates.   Using it in individual templates than default in the stack will also solve this problem or the other way is to keep same display name for the certificate in default template and nested template, this way you can still deploy the certificates through default template to other firewalls. ... View more

Hi @dstjames,   Yes that is how it would work you cant reference template values across in a stack.   Have you kept the same name while importing the certificates (Display Name) in both the templates ?   If you keep the same name (try rename) in both the templates then the default template should supersede and only one certificate should get imported which should take care of your Warning.     The old certificate should ideally be deleted with Panorama push and only one certificate should reflect in the Firewall.   ... View more

Hi s.williams,   For username modifier change that from %USERDOMAIN%\%USERINPUT% to just %USERINPUT% and check in WEBUI and see if that works.   The problem I can see with the older posts is that the domain name when it works fine is taking as domain.lan and when it is not working it is taking as domain only.   So try with %USERINPUT% and enter just the username in WEBUI and see if it works. ... View more