We recently ran into a bug where the Palo was not logging some traffic if it hit a rule that did not have Zones defined.  Does your security rule happen to not have Zones defined? ... View more

Not sure if this is still being updated/supported, but you can try the Pan(w)achrome Chrome plugin. ... View more

In the last few days we've been getting a ton of FP's.  None of these files are related in any way, but one commonality we did find was Wildfire was keying on these 2 things: 1)   Http request without User-Agent 2) HTTP GET requests to x.x.x.x/wpad.dat (x.x.x.x being the same IP every time). Also, our WF500 appliance is reporting all of these FP's.  If we upload the same file to the WF cloud, the files come back as benign.  I have a ticket open with support and they have escalated it to engineering. ... View more

I have a similar issue with GlobalProtect 5.0.3 and Duo MFA.  Not sure if everyone is aware how Duo MFA works with GlobalProtect, but instead of enter in a one-time passcode, you can enter in the number "1" and Duo will send a push notification to your mobile device.  Well, I entered in "1", never got the push notification(not sure why), but this caused the GlobalProtect client to get stuck at "Still Working...".  I waited 25 minutes and the client never timed out, it just kept trying. ... View more

From what I understand, Palo Alto has templates on Github you can use to deploy the PA in an existing Azure environment(without using the marketplace).   https://docs.paloaltonetworks.com/vm-series/7-1/vm-series-deployment/set-up-the-vm-series-firewall-in-azure/use-the-arm-template-to-deploy-the-vm-series-firewall.html# ... View more

Are the subnets equal to each other? Not sure what you mean. Will you generally allow traffic between the subnets? Generally will not allow traffic between subnets. Are the subnets contain different group of servers? (One subnet for linux and one for windows for example) Subnets can contain different types of servers, but mainly are separated by the functions that the servers provide. Do you plan to configure generic zone firewallrules or do you configure specific rules for each server? Specific rules for each server. ... View more

I would do... - LDAP only on the Portal - RADIUS(OTP) on the Gateway   ...Enabling 2-factor on the Portal may cause your users to have to enter in a OTP even when on your internal network.  Is your OTP solution capable of authenticating LDAP as well? (ex. LDAP+OTP over the RADIUS protocol).   ... View more

I had this same issue, but with GP 4.1 only(and on Win 7 and 10).  This little bug was pretty detrimental for us, since we are "enforcing" a Global Protect connection.  The Global Protect service seemed like it was half-way running.  Global Protect could not connect to the Portal/Gateway, which would then block ALL network traffic(because we are enforcing a Global Protect connection).   I opened a ticket with support, but after a little while of troubleshooting, we just instructed our users to downgrade back to 4.0.x. ... View more

I have tested GP 4.1 on Windows 7 and 10, the agent saves the password most of the time.  There are some times where the GP agent will prompt me for my password again.  I don't think this is related to GP 4.1 though, as it was happening on the older version as well. ... View more

@reaperOk, so at no point in the disable process, will the user, or firewall admin, need to enter in this Agent User Override Key? Are you saying this "user override key" is just being used to validate the connection(much like an SSL certificate on a web server is used to validate the connection)? ... View more