About shawnhafen

OK Since this is something that would really be nice to have I tried something new today and it seems promising. Here are the details:   step 0: GP external portal/gateway - working but cannot get valid cert for this using let's encrypt step 1: configure/setup internal portal/gateway step 2: install nginx proxy manager on something step 3: setup proxy host to use your external domain to forward to GP internal IP address (i.e. 192.168.whatever:443) step 4: setup NAT and security policies to allow port 80 and 443 inbound to your nginx proxy manager host step 5: test it... you should be able to hit your internal VPN portal from the internet using your domain name step 6: use nginx proxy manager to auto-generate a let's encrypt cert - this is where I have a problem, for me I get an error and cannot get the cert to generate, i have been trying to troubleshoot this but so far no luck... but I think I have 90% of the way there and this *should* work but something is wonky with the cert fetching process in the nginx proxy manager container   EDIT: It works! for some reason I put 443 in my Destination NAT policy, I must have been still waking up this morning. After removing that and making sure the security policy allows 80 and 443 the proxy manager grabbed a cert and I have a valid chain on the VPN portal now, this should auto renew going forward ... View more

If this is only happening over the VPN then this is a known issue and is also a Microsoft issue that impacts any and all/other VPN clients. This is fixable with some GPO changes, we made these changes (did not require a reboot) and everything worked with the app store 100% of the time immediately.   I do not have the original post link that I found the fix on but I *think* this is the same fix here: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PNL5CAO   ... View more

Here to echo what @OtakarKlier  said. We use the same shoretel/mitel phones and the zone they are in does not get decrypted. To take it a bit further you can use NAC to make sure only phones are on that vLAN too. ... View more

Not sure what those look like as I am not experiencing low disk issues atm but if you cannot set up a filter on anything in the logs (like this)    Then maybe you can set up an email alert in your SNMP monitoring solution (if you do not have one then you can get a free version of PRTG, or use LibreNMS which is free and supports PAN devices very well)   ... View more

You have a few options here:   custom URL category for these URLs block FQDN objects in the destination Add very clear notes to the URL re-categorization request and hope whoever is working it reads them   FWIW: I have always had great luck with re-categorization requests, sometimes you have to explain in the notes that there is something behind the login or there is a redirect etc ... View more

A while back I went down this same path, it is a very loose control and does require a lot of attention because something like a shopping season, COVID stimulus checks, or other events may cause spikes in traffic that you dont want to drop.    Here are some places to look for evaluating your CPS over time: https://github.com/zepryspet/GoPAN https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/zone-protection-and-dos-protection/zone-defense/take-baseline-cps-measurements-for-setting-flood-thresholds/how-to-measure-cps.html#id2f43d329-3860-4689-a2e4-b7d19ded7966   Good luck!    ... View more

I will chime in and say I have not seen this issue on our 5050s, 3060s, 200s, or 220s   SNMP is coming from PRTG and some from LibreNMS so far so good on 8.1.x and 9.1.x PANOS versions.    Suggestions (you may have already done this): * check the mgmt interface settings to make sure the SNMP traffic is coming from an allowed source * check security policies * check community string ... View more

You can do that, however I would recommend scoping the policies down as much as you can. We also migrated from CP and ended up with some pretty silly policies that had to be tuned. each column in the policy is going to strengthen your security stance so the more the merrier I say!   instead of using any any in the zones I would recommend putting each zone that needs that traffic in there, this will also prevent you from unintentionally allowing any zones that are added later you may not want to allow for said policies.  ... View more

This can be done, there are limitations but for the most part you can tune and configure this using the following steps to start: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGjCAK   ... View more