About jambulo

I like the concept of having Strata Copilot and AI Canvas, but I'm struggling with how we can take advantage of these features for day-to-day operations. Drop some ideas here! ... View more

When upgrading PAN-OS on an Active/Passive pair, does any pause for 1 or more days after upgrading the first firewall (and before upgrading the second firewall)?   The idea here is we will have a bit more time to test for issues. If there is a failure post upgrade, we will have the option to suspend the upgraded firewall and make the firewall that did not yet get upgraded, active. ... View more

Over the past couple of weeks we have been getting more and more support tickets stating that our users can't connect to GlobalProtect VPN. The one common thread they have is they all have T-Mobile Home Internet. Has anyone else noticed this? Is there a fix or workaround? Thank you. ... View more

I'm having trouble figuring out what expression to use(in a Custom URL Category) to match any variation of HTTP requests for an entire website.  For example, I want a single expression to be able to match/block/permit the following HTTP requests... example.com/ example.com/path abc.example.com/ abc.example.com/path xyz.abc.example.com/ xyc.abc.example.com/path   So far I've only been able to match all of the above by using 2 expressions in the Custom URL Category... EXAMPLE.COM/ - This will permit example.com/ and any path after it.  Will not permit any subdomains. *.EXAMPLE.COM/ - Will permit abc.example.com/ and any path after it.   Does anyone know of a way to match an entire website using a single expression? ... View more

I'm trying to set up an Internal Gateway for GlobalProtect, and am finding that GP does not connect to the Internal Gateway if the Connect Method is set to "On-demand".  It works just fine if I set it to "Always-on".  Is this the way it's supposed to work or am I missing something? ... View more

We are testing SSL decryption and are finding that Macs are getting a certificate warning page when visiting https://www.apple.com.  The warning says "This website may be impersonating "www.apple.com" to steal your personal or financial information".  These Macs do trust our Root CA, so it's not that.  I put "www.apple.com" in the SSL Decryption Exclusion list and that resolved it.   Anyone know what is causing this warning? Is it certificate pinning? A couple of our Mac testers also reported that they could not download the Big Sur update over GlobalProtect(www.apple.com was not yet in the exclusion list).  Does the Palo need www.apple.com(and maybe others) added to the SSL Decryption Exclusion list in order for Mac updates to work? ... View more