About emr_1

I believe Cloud NGFW is available only with PAYG. Please refer to 6th page of the datasheet. https://www.paloaltonetworks.com/resources/datasheets/cloud-ngfw-for-azure   Simple Procurement and Setup With Cloud NGFW for Azure, you can implement next-generation network security in minutes. Procure Cloud NGFW via Azure Marketplace, set it up with a few clicks, and integrate with native Azure services, such as Azure Key Vault and Azure Virtual WAN. You can set up rulestacks and automated security profiles in only a few minutes. Cloud NGFW for Azure is available as a pay-as-you-go service. You pay an hourly rate for each availability zone where your NGFW is deployed. You also pay for the amount of traffic, billed by the gigabyte, processed by the NGFW. ... View more

I would say 11.1.   From Software EoL perspective, 10.2 will be Limited Support in next month, thus PAN does not release updates for P2 or lower (non-critical) issues https://www.paloaltonetworks.com/services/support/end-of-life-announcements/end-of-life-summary https://www.paloaltonetworks.com/services/support/end-of-life-announcements/end-of-life-policy#lsupport   From Hardware EoL, you have no chance to grab 11.2 for PA-3250. It says last supported version is 11.1. https://www.paloaltonetworks.com/services/support/end-of-life-announcements/hardware-end-of-life-dates   ... View more

Even I'm not living in Europe, I think there is no restriction (minimum amount of credits) for purchasing credits. At least I could buy 15 credits in APAC. If "with minimum of 500 Credits" is true, I believe this is rule in reseller, not palo alto networks. Thus, I suggest to contact other reseller. FYI: By the way, I could add 45 credits here. (just proof you there is no minimum) https://www.markit.eu/au/en-au/pan-software-ngfw-lab/v2p32331715     ... View more

Yes, you need subscriptions/licenses to detect (and also to block) ... View more

Thanks for reply. I understood that. ... View more

It depends on your configuration of... -split tunneling -security rule (especially for DNS, HTTP, HTTPS in this case) -nat rule (from GP tunnel to internet)   Please look at your config and logs, and find out how is your traffic is handling by PA device. ... View more

If you are currently using "External Gateway (auto discovery)" mode which described in following url: https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-gateways you can use manual mode instead.   After configuration, on user side, he/she can select which gateway to connect. ... View more

https://status.paloaltonetworks.com/incidents/d3bs717c7yq8   Even this information is for prisma access, you might find the hints. If you are using decryption rules, bypass rule might help you. ... View more

At least you need to take care of two locations.   One is DNS proxy as mentioned in previous post:     Secondary, you need to configure to use dns proxy by system (pan device itself) as below:     Here is my result: ==== admin@PA-455> ping host abcsampledomain.com  <<< Before configuring above two ping: abcsampledomain.com: System error admin@PA-455> show dns-proxy static-entries all Name: dnsproxy Static Entries: 2 Domain IP/Name Type Class TTL Hits Static ----------------------------------------------------------------------------------------------------------------------------- 4.3.2.1.in-addr.arpa abcsampledomain.com PTR IN 0 0 config abcsampledomain.com 1.2.3.4 A IN 0 0 config admin@PA-455> ping host abcsampledomain.com <<< After configuring above two PING abcsampledomain.com (1.2.3.4) 56(84) bytes of data. <<< you can see IP address ====   ... View more

You can see currently installed version which is not preferred if you uncheck both boxes at bottom. Here is sample from my testbed:       After uncheck.... ... View more