Global Protect 3.1.1 PAN-OS 7.1.5 specific user policy match issue

Hello Guys,

Having an issue with GP USER-ID policy match. 

The user is mapped correctly:

The user connected to the GP but unable to access internal resources as per below policy:

Changing user id tab from the specific (mapped user) to the "known-us

URL Filtering from Internet Traffic to Internal Websites

Been doing some searching but havn't come up with anybody doing this and if it has other problems / security ramifications I'm not aware of.

My problem:

We have an employee that is no longer working at our business but there personal computer at home

LAN to Globalprotect VPN network not reachable

we have configured the GP VPN as follows,

LAN: 192.100.1.0/24, gateway: 192.100.1.50->core switch->lan e1/1-192.100.1.55 PA -->tunnel.1 (same zone as LAN) 192.168.254.1/24.

GP IP pool: 192.168.254.2-192.168.254.254

Access route is proper: as traffic f

Palo Alto Updates not passing through another PA firewall

Network setup:

PA3020 E1/2-->E1/1 PA500 E1/2-->Internet.

In PA3020, we have configured the service route to paloaltoupdates through e1/2. Then traffic will reach pa500 e1/1 which will be routed to internet via e1/2. PAT configured on e1/2 which will

Google drive not getting blocked

Dear Team,

As per logs, I am getting drive.google.com is blocked.But actually, I can still able to access it. 

Please advise regarding this issue to get fixed. Give us the proper permanent fix for this issue.

I can block mentioning the specific URL “dri

Block web browsing but allowing other apps.

I need to block webbrowsing but allow other apps which has web dependency.

Trust to untrust - all allowed. But when I deny webbrowsing from trust to untrust other apps like skype stops working.

Requirement is only web-proxy ip is allowed webbrowsing fr

2 Factor Auth Issue

Hello,

We are having issue with GlobalProtect VPN client when using 2 Factor Authorisation to authenticate.

Instead of being presented with a second login prompt to enter the code from the keyfob, Palo Alto is rejecting logins unless the keyfob code

Palo Alto xml element tree

Looking to build a Palo Alto python script from scratch. Does Palo Alto have a WSDL or element tree document to provide a starting point?

PBF SMTP for both ISP1/ISP2

I'm wondering if anyone has a similar setup and got it working. I'd like to have both SMTP services enabled on two ISPs for load-balancing and redundancy. I tried using PBF but couldn't get it working. It seems SMTP for ISP1 works fine but SMTP for I

Global Protect Client Improvement

Hey all,

Not sure if this is allowed - so if it's not, feel free to delete my post.

Natively, the Global Protect client has no support for saving credentials, which is kind of frustrating if you're like me and jump between portals on a regular basis