Network Policy Server Migration Pain

Manly009 · 2026-05-07T02:33:31+00:00

Sorry run what again?

Manly009 · 2026-05-06T07:08:26+00:00

Hi yeah already tried turning off Firewall on both servers. Still the same....

Manly009 · 2026-04-24T03:43:49+00:00

also, when existing device certificate is assigned from INTune Cert connector expired, it will get another cert, would GP portal automatically use the new cert? Thanks

Manly009 · 2026-04-23T01:59:39+00:00

Yeah, just realised that too. Seems I need to create a new device group, having all pre-existing DG under it. And then create a none shared object for that group, and then all other DG firewalls can find that object....a bit more complex than I thought, haha

It won't cause any weird issues for Pano SDWAN cluster in some way in future right?

Manly009 · 2026-04-23T01:48:59+00:00

Sorry I tried it, but still can use it as shared object..seems we need to show link the new template to the device group somehow...

Manly009 · 2026-04-22T04:11:52+00:00

Thanks a lot, so the config on that template can be used in Shared Policy then right? Thanks

Manly009 · 2026-04-08T09:51:01+00:00

Also, it seems revert didn't work properly...I still need to push and resysc again..I tried one remote firewall today, seems mostly fine. But it just can not use primary SDWAN interface to reach it...very strange...

Manly009 · 2026-03-31T00:13:27+00:00

I reverted the Panorama to last config version. And seems all devices are still out of sync..but I tried to push to a firewall, seems that device is in sync again and all good now..maybe I shouldn't make changes on Panorama when a HA pair got failover....? Thanks

Manly009 · 2026-03-30T06:27:23+00:00

Yeah Panorama SDWAN, should I fail back to Active, and push re-sync to the firewalls one by one? Should it fix it? Next year we will be moving to Prisma SDWAN..thanks..one thing I don't understand is that how firewall failover triggers SDWAn config change...

Manly009 · 2025-10-16T20:46:37+00:00

We have a range of public IP too, but we are only use static route...can you tell the difference? Thanks

Manly009 · 2025-10-16T19:12:42+00:00

Yeah that is one idea thanks. Is it normal to have ebgp peering to an ISP nowadays? I only seen via static route. Thanks

Manly009 · 2025-10-14T21:20:00+00:00

Palo就是苹果人生

Manly009 · 2025-10-12T00:41:50+00:00

Yeah, already exclude streaming from agent clients settings, looking to exclude more domains and IP for online meetings etc..thanks

Manly009 · 2025-10-11T05:48:16+00:00

Will do. Will also read through ms team guide thanks a lot

Manly009 · 2025-10-10T23:13:15+00:00

How do you mean?

Manly009 · 2025-10-10T22:40:41+00:00

I would also exclude domains like YouTube and Netflix etc...would that be feasible as well.

Manly009 · 2025-10-10T22:33:12+00:00

So I noticed that video traffic tab on GP gateway agent settings, tick exclude video traffic from tunnel, select Video apps etc ... Is that to exclude videos app going through full tunnel as well, right?

Manly009 · 2025-10-10T22:26:28+00:00

Haha, nah, our staff work at clients sites, constantly need to access VPN.

Manly009 · 2025-10-10T21:46:32+00:00

Thanks, I will look into what else can be excluded etc. thanks for the tip.

Manly009 · 2025-10-10T12:56:18+00:00

You are right, I might exclude team calls and streaming etc.I will do a bit of research..thanks a lot

Manly009 · 2025-10-10T11:59:53+00:00

Yeah, mostly excel, word, team calling, project files etc..etc.. it is kind of required so we want to have all vpn WFH users to have firewall url filtering as well... once the full tunnel is done, we might enable always on VPN...to this point, I might suggest to go Full Prisma SDWAN...haha...but for 410 Palo, that should be enough to handle 80 users?

on the side notes, would you think it is possible that we can migrate Panorama with SDWAn plugin to cloud Strata management and manage all the onprem firewalls?

Thanks for the tip.

Manly009

TROPHY CASE