About RREALICA

We are currently testing Globalprotect for IOS and we are seeing this notification in the phones - "Globalprotect Always-On mode is enabled. Please sign in to continue"   Everything is working as expected in our test setup which is on-demand, using Azure SAML for authentication with client certificate - the one thing we don't understand or not make sense is the misleading notification that pops-up; this gets triggered if try to connect the VPN via Settings > VPN.   Launching the Globalprotect client manually and login from there is working as expected.   We don't see any configuration that is being pushed via MDM or via the GP Agent that would indicate "always-on" is enabled.    Anybody else seeing the pop-up? Is there a way to control/configure it?  ... View more

just to give a baseline - hardware are pa-5220, running 10.1.6-h6, HA (active/passive), device managed by Panorama.   Long story short - one of the firewalls got stuck on a reboot cycle where the firewall would reboot every 85 minutes. The data plane would not come up during this time and support processed a RMA.    For the fun part: our initial attempt to restore, after upgrading the same software level as working firewall, we used a device state backup, everything sync up properly, when we tried to pass traffic through the new firewall we saw the following strange behavior: source zone and destination zone was not showing up in the logs some zones were being identified but was incorrect, for instance DMZ, is showing up as Trust destination country was reporting incorrectly, for instance traffic for United States is showing up for Uruguay traffic seems to be flowing properly even though rules were not being identified in the logs 2nd restore attempt we used a back from a day before the firewall failed, we had no issues with synching up in this case as well. this gave us a better experience. all traffic flows looks good on the log, zones and rules were being identified properly destination country looks good as well the one problem we noticed was that the IPSEC tunnels would not come up - after troubleshooting with support even a simple command "ping source x.x.x.x host y.y.y.y" where x.x.x.x is one of the firewall interface ip results in "bind: Cannot assign requested address".   We checked for "untagged sub interface" like suggested by others but none found. Any feedback, suggestions would be appreciated. A TAC support is currently open and waiting feedback as well.   Thanks.   ... View more