About MMerlier

Hello,    I've been trying to add a new TS agent on my firewalls. As there is no redistribution for user-{ip+port} mapping, I want to map the TS agent to 2 FWs. Backend FW is connected correctly, Frontend FW is in error. I can capture the following between FW and TS agent : - FW to TS : SYN - TS to FW : SYN/ACK  - FW to TS : ACK - FW to TS : RST   I've got the following error: show user ts-agent state not-conn:idle(Error: Failed to Connect to 1.1.1.1(source: 2.2.2.2), SSL error: error:00000000:lib(0):func(0):reason(0)(5) )   Also on TS agent side I've got the following error: 05/04/22 12:33:57[Info 1571]: Client thread 2 with IP 2.2.2.2 is started. 05/04/22 12:33:57[Error 1946]: SSL 2 accept error: 5-10054! 05/04/22 12:33:57[Info 1659]: Connection 2.2.2.2/39560 closed.   The thing is that there is no certificate configured for any user ID agent. I tried to restart user-id process on the FW with no success.   Does someone have an idea ?   ... View more

Hello,   Did somebody successfully implement this feature ? I'm working on GP 5.0.7 and PANOS 8.1, also we have a Global Protect Gateway license active.   I want to exclude video traffic from the VPN tunnel. So I go to my external gateway, and enable exclude video traffic. The tunnel mode is enabled, and also in the agent config, the split tunneling is enabled (ie the option "no direct access to local network" is disabled).   When I add application like dailymotion or netflix-streaming, I still can see such application going through the firewall. When I let the application panel empty, expectation is that ALL video streaming traffic is excluded from VPN. But that is not working either.   So I'll be glad if someone encountered the same issue and resolved it 🙂   In parrallel, I'm using standard split tunneling via subnet IPs, and this is working well so far. But I want to make video traffic exclusion work. ... View more