About MP18

MP18

@aarato We are running PA 3260 in Active passive PAN OS 9.1.5 and 8.1.9. No issues so far. Regards

MP18

@calumetcounty Do you have any QoS enabled? How many max sessions you have? Regards

MP18

@RileyDylan Please see links below. They explain how to do this setup. https://www.consigas.com/best-practices/authenticating-globalprotect-and-prisma-access-remote-access-users-against-office365-azure-ad https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/palo-alto-networks-globalprotect-tutorial Regards

MP18

@nexusjedi I tested from My PA same thing bytes sent but no traffic coming back. I see SYN packet going from my PC but no syn ack from server. Please check with Vendor. Regards

MP18

Which PAN OS you are running? Do you have issue only with this FQDN or other FQDN's also? For me it is resolving show dns-proxy fqdn all FQDN Table : Request time 2021-01-09 20:56:53 -------------------------------------------------------------------------------- IP Address -------------------------------------------------------------------------------- VSYS : (using mgmt-obj dnsproxy object) Shared vsys1 cco.siemens.com 212.231.11.154 :: unknown Normally this happens if IP in Security Rule does not match the FQDN IP address. Sometimes FQDN object not refreshing properly. Also Check traffic logs to see which rule it is hitting. Double check your security policy rule. Also try this from CLI request system fqdn refresh Regards

MP18

@AubreyCooper You can assign same Interface to Multiple zones. But Interface can be assigned to Single Zone only at one time. You can assign same all 3 Interface to new zones. I never done this but it is doable. Also it is not recommended best practice as now if you want to segment the traffic between 3 different zones then you can not do that now. Only thing if you have to worry about is VR if all 3 Interface are in same VR then you are good if they are in different VR then you need to modify the static routing in 3 VR's. Regards

MP18

Normally GP Agent connects to the gateway which has fastest SSL connection time. So This can be one of the reasons. You can try one of below things Also On agent You can put the preferred gateway at the top. Last thing you can also modify registry setting for GP to add the preferred gateway there. Regards

MP18

@NamalW Also you can push this registry setting with GP agent then cert pop up will not occur. Check this link Certificate Selection by OID (paloaltonetworks.com) Regards

MP18

@engreda22 As per my understanding your issue is that if someone does nslookup for the firewall public ip then it should not resolve right? This depends on your DNS server where you have a host or A record entry for your firewall hostname and Public IP address. It also depends if you have your firewall public IP used for VPN etc then you need your firewall need to resolve it. In our company we have firewall public IP address that is used for natting and external connections coming from Internet to our public facing apps but those IP does not resolve as we have our own DNS server with Internal and External Zone. Also we have Global Protect VPN that has public IP address and that address gets resolve as we need that to make VPN work. Also we have DNS entry for our firewall VPN hostname with Public IP address in our DNS External zone. Let me know if you have any more questions. Regards

MP18

@Rajab725 Do you want to do config of tunnel interface via CLI or GUI? Regards

MP18

@Lance Please see this link https://live.paloaltonetworks.com/t5/log-forwarding-discussions/quot-number-of-hints-on-disk-has-exceeded-5000-due-to-log/td-p/237571 ************************ As we don´t have an Panorama anymore they activate the HIP Mach parameter: "hipmatch-any" to Panorama (under Device--> Log settings). After that we check with "debug management-server rawlog_fwd show hint-state" that we have a lot of records in Number of hints on disk (over 19200) so they clear all this hints with "debug management-server rawlog_fwd clear hints-all" untill reach 0. We deativate the HIP Match to the Panorama and commit After that we don´t have more alarms ********************** Regards

MP18

@Rajab725 Do you have Multi vsys config in PA? Regards

MP18

@banksants Are you looking for some CLI command like below ? t network virtual-router NetGear protocol bgp + allow-redist-default-route allow redistribute default route to BGP + ecmp-multi-as Support multiple AS in ECMP + enable enable + enforce-first-as Enforce First AS for EBGP + install-route Populate BGP learned route to global route table + local-as local AS number + reject-default-route do not learn default route from BGP + router-id router id of this BGP instance > auth-profile BGP authentication profiles > dampening-profile route flap dampening profiles > peer-group peer group configuration > policy BGP routing policy configuration > redist-rules redistribution rules for export through BGP > routing-options routing instance options <Enter> Finish input Regards

MP18

@CirilRamos Please check below I have observed that the connection is instant in our environment if the user unchecks the "Automatically Detect Settings" for the proxy option under Internet Explorer. Even if the user does not have a proxy server, the proxy settings may be set in Internet Explorer. This is where the issue resides and the reason why some clients exhibit the problem (where the proxy settings are set). When reviewing the GlobalProtect client logs, the user might see: (T2760) 12/09/13 09:43:16:863 Debug (4651): Auto detect proxy for host vpn.domain.com (T2760) 12/09/13 09:43:37:908 Debug(4662): CPanMSService::SetProxyForHost: fAutoDetect: 1 url: proxy: bypass: url: https://vpn.domain.com/ returned proxystr: In the example above, it takes 31 seconds for the Windows system to detect the proxy setting. The result is no proxy for https://vpn.domain.com/, even if the url is opened. Please check the GPS logs from the client and look for below logs Uncheck the "Automatically Detect Settings" for the proxy option in Internet Explorer to speed up GlobalProtect connections. With this setting enabled, the GlobalProtect client reads the proxy settings in Internet Explorer even if there is no proxy server.

MP18 · ‎12-15-2020

@rjdahav163 Which PAN OS version you are running? IF you are running PAN OS 9.0 it will show you the applications used on the port based rule. Then you can clone the app based rule above the port based rule and reset the hit counter on port based rule and monitor if traffic still hits the port based rule or not? This way you can have app based rules. Regards

Date Registered	‎10-07-2017 08:47 PM
Date Last Visited	3 hours ago
Total Messages Posted	1,361
Total Likes Received	82

Online Status	Offline
Date Last Visited	3 hours ago

About MP18

Re: HA Configuration on PA-3220 - HA1 is UP but HA1 Backup is Down

Re: Slow ISP bandwidth through PA-3020

Re: GlobalProtect with Azure MFA setup

Re: Having issues with GoDaddy redirect sites from IP 184.168.131.241

Re: FQDN object not resolved

Re: Slow ISP bandwidth through PA-3020

Re: Global Protect Pre-Logon followed by SAML SSO

Re: Global Protect client showing Gateway name instead of Best Available

Re: IPSEC vsys cli

Re: IPSEC vsys cli

DOTW: TCP Resets from Client and Server aka TCP-RST-FROM-Client

Re: Cisco BGP neighbor x.x.x.x local-as yyyy feature on Palo Alto

Re: LIVEcommunity 2020 Year in Review

Ignite 2020 Coffee Table Chats Times

Re: Link down between Firewall and Syslog server

Re: HA Configuration on PA-3220 - HA1 is UP but HA1 Backup is Down

Re: Slow ISP bandwidth through PA-3020

Re: GlobalProtect with Azure MFA setup

Re: Having issues with GoDaddy redirect sites from IP 184.168.131.241

Re: FQDN object not resolved

Re: Zone for vpn?

Re: Global Protect client showing Gateway name instead of Best Available

Re: Global Protect Pre-Logon followed by SAML SSO

Re: How to prevent my firewall to stop responding to external DNS queries

Re: IPSEC vsys cli

Re: General - PA 5220

Re: IPSEC vsys cli

Re: Cisco BGP neighbor x.x.x.x local-as yyyy feature on Palo Alto

Re: Delay on initial connection with globalprotect session

Re: Default Outbound Security Policy

Strata

Prisma

Cortex

About MP18