About OGMaverick

I think it was:   <dict>         <key>Action</key>         <string>Connect</string>         <key>SSIDMatch</key>         <string>SampleSSID</string> </dict>     These links were used for reference.  I don't deal with the iPads or the MDM system to know absolutely for sure that it's still working or if it's exactly what was used.   https://nerd.one/vpn-on-demand-configuration-profiles-for-ios-and-macos-explained/   https://www.derman.com/blogs/Example-iOS-VPN-OnDemand-Rules   https://www.codingmerc.com/blog/ios-vpn-on-demand-profile-with-openvpn/ ... View more

We were able to go with the 'On Demand' option and then add XML to make it always connect when on our SSID.  It's staying connected through reboots now.  Now our only other issue is iPads all of a sudden prompting for portal/user even though it has been pushed out in the profile ... View more

Not sure where you actually see step 2 as the official recommendation.  Palo's upgrade articles specifically say to just download a feature release, and then download & install your target release.  So for instance from 8.0.11 to 8.1.9 would be:   - Download and install latest 8.0 (8.0.20) - Download 8.1 - Download & install 8.1.9     " In most cases, the recommended path when moving from one feature release to the next is to download the base image for the next feature release version and then download and install your target maintenance release version. " https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-new-features/upgrade-to-pan-os-90/upgrade-the-firewall-to-pan-os-90/determine-pan-os-upgrade-path.html         ... View more

We did attempt 'Pre-Logon' however when the iPad is rebooted the VPN doesn't automatically re-connect. ... View more

Thank you.  I was able to get one of the student iPads to test.  I can connect, but as soon as I power off then on the connection doesn't resume.  I'm wondering if maybe this is a setting that the group pushing a config to the iPads needs to configure ... View more

Could you put a rule before the one blocking netflix-base that allows URL techblog.netflix.com?  Also medium.com/netflix-techblog, since it appears to just re-direct there, or possibly just visiting that directly will circumvent your issue altogether. ... View more

I'm not sure if maybe you just mean your WSA isn't doing decryption, but WSA does support it.  We had a rack of them that were also decrypting before we moved to PAN. ... View more

FR ID 11012 looks to be completed as per https://docs.paloaltonetworks.com/compatibility-matrix/user-id-agent/which-servers-can-the-user-id-agent-monitor# ... View more

On our network of >30k devices, we have not had one single complaint after blocking QUIC a couple years ago.  What kind of horrible user experience are you running into? @DShofkom33x  ... View more

2 rules is going to be an OR.  If you want it to match an application & port, they need to be within the same rule.  Everything you match on in the same rule is an AND.   If you do those 2 seperate rules, it's going to allow ALL web browsing traffic on its default ports(80/443) as well as allow all traffic, web browsing or not, over tcp port 7777.  You could test the single rule requiring both app web-browsing/ssl & your custom service. ... View more

Does this only affect the user-id agent or does it also affect Agentless?  I'll still e-mail our rep regardless since it seems like a feature that should surely be in by now!   EDIT - Just saw your earlier reply.  This blows - our server team has already been planning on upgrading all DCs to 2019 this summer. ... View more