About knarra1

Hello Martin   Please review the following link which has details on how you get the data you are looking for  https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-new-features/globalprotect-features/enhanced-logging-for-globalprotect.html You can now run custom reports on detailed logs for GlobalProtect. You can use predefined templates or create your custom reports from scratch.   Regards, Kalyan ... View more

Hello,   What is the GP version installed on the client?. For macOS Catalina,  GP version 5.0.4 and later are supported    Following link has the compatability matrix list for your reference https://docs.paloaltonetworks.com/compatibility-matrix/globalprotect/where-can-i-install-the-globalprotect-app.html#id7a3c3401-b233-43b0-8d78-dfceab88798f_ided455b67-d953-44bc-9934-592ec1d3b7a2   Regards, Kalyan ... View more

Hello Mario,   Do you have a MDM that manages Android for Work devices ?  If so, there could be restrictions on applications that can send traffic through VPN . If you have a work profile defined that separates personal and business apps, please make sure to include your application in managed apps under work profile to send traffic through the VPN . Thank you    Please review following link for more details https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/mobile-endpoint-management/set-up-a-mobile-endpoint-management-system/manage-the-globalprotect-app-using-other-third-party-mdms/configure-the-globalprotect-app-for-android.html   Regards, Kalyan  ... View more

Hello,   Can you please try using the following package which is an Windows Unified Platform package and compatible with Surface X https://www.microsoft.com/en-us/p/globalprotect/9nblggh6bzl3?activetab=pivot:regionofsystemrequirementstab   From GP 5.1 release Windows 10UWP is supported on both intel and ARM devices . please check the following compatibility matrix for reference https://docs.paloaltonetworks.com/compatibility-matrix/globalprotect/where-can-i-install-the-globalprotect-app   Thank you Kalyan ... View more

Hello Richard, If the firewall is deployed in layer 3 mode, make sure the VM NIC settings in firewall VM matches to the firewall determined interface Mac address . You will have to shutdown the firewall VM in vsphere and manually edit the MAC address for each vmNIC in vSphere to match what is assigned on the VM-Series firewall If you are deploying the VM-Series firewall using layer 2, virtual wire, or tap interfaces you must enable promiscuous mode on the port group of the virtual switch to which the data interfaces on the firewall are attached. If promiscuous mode is not enabled, the firewall will not receive any traffic because the destination MAC addresses assigned by PAN-OS will be different from the vmNIC MAC addresses assigned by vSphere. ... View more

In HA configuration , phase2 ipsec is synched between the Ha pairs and you should see automatic failover to secondary device when it becomes active with out need for rekeying . But phase 1 is not synched as it is not necessary . In GUI you should see the main status (which is for phase 2 ipsec)  for tunnel green and the IKE status Red which is expected behavior. The purpose of phase1 (IKE) is to setup a secure channel for subsequent phase 2  (IPSEC) security associations (SA).  Once the phase 2 security associations have been setup, traffic travels on phase 2 SA.  Hence phase 1 can be down but traffic across the tunnel still works (because phase 2 is up). ... View more

Looks like you might have mismatch between the proposals configured between the two devices . Make sure the proposals chosen on both sides are matching ( Encryption, Authentication, DH Group , life time and life size) ... View more

one way to identify if pc is domain or non-domain is to make use of the HIP profiles and use the hip profile in the security policy. To get the HIP report, you will have to configure gloabal protect for internal gateway . You will need Global protect portal license for internal gateways https://live.paloaltonetworks.com/docs/DOC-3930  - How to Configure Internal GlobalProtect Only https://live.paloaltonetworks.com/docs/DOC-6066  - configuring HIP profiles to use in security policies ... View more

Following is example for your reference to have better idea 15:51:06-­‐ user visits news.google.com 15:51:40-­‐ user clicks on "Entertainment" link 15:52:46-­‐ user clicks on news article 15:54:00-- user closes window Total browse time -­‐ 2:54 minutes Given a page load time of 20 seconds, we will ignore entries between 15:51:06 and 15:51:26. The next entry is 15:51:40, which is within the browse time window (start time of 15:51:06 + 60 sec = 15:52:06), so we consider it as user activity. We now ignore entries between 15:51:40 and 15:52:00 as page load elements. The next entry is 15:52:46, which is outside the browse time window (15:51:40 + 60 sec = 15:52:40), so we consider that a new browse session. We take the last entry that we considered, and assume that is the last request, and add the average browse time to get the final end time. For the above: Start = 15:51:06 (category news-­‐and-­‐media) End = 15:51:40 (category news-­‐and-­‐media) + 60 seconds = 15:52:40 Total browse time = 1:34 min Regarding the Zero browsing time for some URLS, it is expected behavior where the urls that are visited with in the configured page thresholds of the initial page are not considered as part of browsing time. For the purposes of calculating close to actual browsing time, we ignore all log entries from the start time through the page loading threshold time that can be configured in Logging and reporting settings under Device --> Setup --> Management tab. ... View more