This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
About GOMEZZZ
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About GOMEZZZ
05-17-2022
21Posts
3Likes
1Solution
May 17, 2022Last Visited
User
Activity
User
Profile
Latest posts by GOMEZZZ
| Subject | Views | Posted |
|---|---|---|
| 629 | 03-20-2022 05:13 AM | |
| 708 | 03-06-2022 09:16 AM | |
| 2529 | 07-29-2021 12:45 AM | |
| 966 | 10-20-2020 09:03 AM | |
| 973 | 10-20-2020 08:50 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 05-18-2020 05:42 AM | |
| 1 Like | 07-11-2019 01:49 PM | |
| 1 Like | 03-06-2018 10:20 AM |
User Badges
Community Statistics
| Member Since | 03-06-2018 07:41 AM |
| Date Last Visited | 05-17-2022 08:18 PM |
| Posts | 21 |
| Total Likes Received | 3 |
03-20-2022
05:13 AM
Hi, Can you configure multiple portals in Prisma Access to test out things before going into production. For example a portal prod.companyname.com and dev.companyname.com. The object is to test out different authentication methods before going live. Switching to always on and pre-login tunnels including internal portals. But we would of course like to test this out before going into production. A separate portal seems the best way to go for this. Or any other ideas are also welcome.
... View more
03-06-2022
09:16 AM
Hi, I have the following situation, a HA cluster managed by panorama. For testing purpose I would like to downgrade it to an 8.1.21 release. Coming from 9.1.12 release. Couple of question: Should I always perform upgrades / downgrades from Panorama, I they are panorama managed? (upgrading cluster I did without panorama using Ansible script and manual approach using webgui) When you downgrade a firewall it always asks what version you would like to use (running-config or autosave configs) Most documentation says use the autosave of the previous version if it is still on the device, in this case I do not have the autosave for the version 8.1.21. When I using the running config I will convert it to compatible 8.1.21? Regarding the configs when managed by panorama there is nothing in the config besides the mgt IP's and panorama, when I do a named configuration export. Only the system state will show the configs received from panorama. Using webui downgrade I was able to get back to 9.0 release. Going to 8.1 failed and I had to revert to 9.0 again using the debug swm command. When downgrading will the palo fetch the config from panorama? (normally push only (new to panorama) Trying to understand how the downgrade would work and why it failed for the 8.1 Tnx
... View more
07-29-2021
12:45 AM
Hi Housing1, As of today I am not aware of any direct integration with Azure AD.(used id agent for azure) If you have Azure Active Directory Domain Services you could get group mappings using ldaps. https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/authentication/enable-group-mapping.html . To get the user info you could use a global protect client internal portal for authentication only using SAML. (portal non-tunnel model) Or you can setup a captive portal with SAML authentication to Azure AD. Depends on you use case. I think the best option is to use global protect client. For windows laptops no license is needed only for mobile endpoints and linux clients.
... View more
10-20-2020
09:03 AM
Hi Valentine, Thank you for thi interesting approach, i would like to test this in lab. Can you point me to a direction on how to do the vlan tag rewriting on palo.
... View more
10-20-2020
08:50 AM
Hi Valentine, Thx for this interesting approach, could you point me into the direction of how I do the VLAN tag rewrite on the palo side. I agree the best approach is moving SVI to palo but i would like to test you suggestion. Kind regards, Frederik.
... View more
06-02-2020
01:34 AM
Hi, I have a question about using palo alto for east west traffic inspection in an NSX-T environment. There are 2 deployment models in a service cluster and per host model. https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/set-up-the-vm-series-firewall-on-nsx/set-up-the-vm-series-firewall-on-nsx-t-east-west/supported-deployments-of-the-vm-series-firewall-on-vmware-nsx-t-ew.html The largest VM-series 700 has a throughput of 8 Gbps Threat prevention. How do is scale this for larger throughput ? In a service cluster for example? Can i just add firewalls to increase performance? Does it act like a single cluster ? Or do i have to create seperate redirection policies to different firewall groups? Kind regards, Frederik De Muyter.
... View more
05-18-2020
05:42 AM
1 Kudo
Hi, There are different options for your problem but moving everything to the cloud will need carefull planning and decisions up front. A good read is also: https://docs.microsoft.com/en-us/azure/active-directory-domain-services/compare-identity-solutions Also please have a look into Prisma if you are moving to full cloud.
... View more
05-18-2020
02:13 AM
Hi Olsen, If you are using Cisco ISE you could try forwarding you logs to a palo alto user id agent configured as a syslog listener. https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/user-id/map-ip-addresses-to-users/configure-user-id-to-monitor-syslog-senders-for-user-mapping I have not tried it myself but was also something i was thinking about. Another thing you could to is use an internal portal only without creating a tunnel but only for authentication. This is called a non-tunnel mode gateway. (always on configuration) https://docs.paloaltonetworks.com/globalprotect/8-0/globalprotect-admin/globalprotect-gateways/globalprotect-gateway-concepts/types-of-gateways This will require you to deploy global protect to all your clients. This solution will give you the most accurate solution I think. I am assuming all your users and computer are in azure ad only? How are your users authenticated on the WIFI?
... View more
05-15-2020
08:25 AM
Hi Olson, No user-id agent for azure directly but you can solve this issue by using global protect and SAML authentication. It depends on what you need and what is your use-case. What do you want to accomplish in the end? You can also look into Prisma.
... View more
12-06-2019
09:53 AM
Hi. what you could to to get the user id is use global protect client with SAML authentication to azure. You can connect to internal or external portal and use always on.
... View more
12-04-2019
01:17 AM
Hi, I would like to accomplish the following I have an always on VPN configured to use user-id password at logon. When the user is on one of our remote sites with know public IP's I want to use only LDAP in all other situation when he is external I want RADIUS(MFA). Can I make an authentication profile and link it to source IP? Kind regards, Frederik
... View more
07-11-2019
01:49 PM
1 Kudo
Hi Jeff, Any idea if this i a feature that will be introduced or palo alto is considering this?
... View more
07-11-2019
01:47 PM
Hello, I have the following question is it possible to assign multiple authentication profiles to globalprotect. I wan't to accomplishg the following: Users of LDAP GROUP X.: Use LDAP authentication only. Users of LDAP GROUP Y: User RADIUS auth with MFA capabilities. Is this possible an how can i accomplish this? If somebody could point me into the right direction. The main reason for asking this is because my radius server (Microosoft NPS server with MFA extension) by default forwards all request to MFA. And i want certain users to be able to bypass MFA. Any help on this would be appreciated.
... View more
05-02-2019
01:06 PM
Hi Jeff, I have dropped you an e-mail with my contact details. To get around this limitation i could maybe user a captive portal and SAML SSO? In my case these user are all on a seperate segment. I will have to test this out. Never the less integrating User-ID with Azure AAD would be a good enhancement.
... View more
04-04-2019
01:02 PM
Hello, We have PC's that are only registered inside Azure AAD and managed via Intune they have no connection to the on-prem AD and are connecting via a Wifi zone behind PA to the internet. How can i determine the USER id, without user interaction. Or do i need Global protect for this and SSO? Is there someting like a User ID agent for Azure AAD. Or maybe i can use SAML SSO with Azure AAD for captive portal, can somebody point me to a good article on how to configure this.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-17-2022
08:18 PM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks