About JoergSchuetter

The passive device does not respond to anything (besides on the mgn interface). That's due to moving the IP and MAC to the active node, the passive node has no IP on the "traffic" interfaces. If you have LLDP enabled, please verify that "Enable in HA Passive State" is ticked (Interfaces --> Ethernet --> your Interface --> Advanced --> [x] Enable LLDP -- [x] Enable in HA Passive State) ... View more

Hello @Schwarzer  If you change the name of the Zone in panorama, it will (at least that's my experience from ~1 year ago) change all and every object with the same name. Even if this is OK for you, you might end up with the situation that "device groups" and "templates" are not installed at exactly the same time. Policies require a zone which does not yet exist, or interface is bound to a zone where no rule has this zone listed (hence not granting traffic). We created a new zone with the new name, added this zone to all rules where required and pushed the config to the firewalls. Once this was done we replaced the zone on the interface(s) and pushed again. ... View more

Hello @yelfilali  I would be surprised if this is possible at all. A fqdn could result in 0, 1, 2, ... IP addresses. If the result could be ambiguous, best way is to not use/allow these input types. ... View more

Hello @ZachHeise  Using GP as an identity provider is possible. GP needs to "talk" with a VPN gateway on a regular base, but establishing a VPN tunnel is not required. Hence more or less the same config as for the remote users, but without the VPN part (see tab "internal" on portal config). In addition to this, there is a component named "Terminal Server Agent". It does not work for all applications (e.g. SMB fileshare is not bound to a user). This limitation is due to the fact that it's not possible to enforce the source port for SMB. ... View more

Hello @MHuschenbett  I guess you need to embrace your call with another layer holding the name of the ae interface. For us it is obvious that ae2.155 is below ae2, but how should the machine know this. ... View more

Hello @palomed  Do you have a GlobalProtect license installed on your VPN gateway? The domain split feature requires that license to be installed. ... View more

Hello Is there a reason for limiting the VPN session time? I know this doesn't answer your question, but changing the session time might solve your need as well. ... View more

Hello @Lisensi-KAI  Do you have the GP license installed on that firewall? Without this license you are able to provide VPN (with limited features) for Windows and Mac, but not for Linux, Android or iPhone. ... View more