About santonic

santonic · ‎01-16-2020

We have a situation where we can't get all the mirrored traffic to the same interface. But as it's asynchronour souting nevironment a packet can be mirrored to one interface and the reply to the other. So we need to connect 2 PA TAP interfaces to capture whole sessions. The question is will PA match the packets into same session if we put both interfaces into the same security zone?

santonic · ‎11-20-2019

Yeah, logs are fine. So we assumed it's ok. Just wanted to be sure so it doesn't bite us some time later.

santonic · ‎11-19-2019

Scenario: Panorama (in Panorama mode) with single local Log Collector A/A cluster of firewalls managed by this Panorama We managed to change the master key on Panorama and both firewalls. But trying to change the master key of the single local Log Collector on this same Panorama fails with "Failed to schedule deploy masterkey job". Is it even neccessary to change this master key in this scenario where Log Collector is on the same (virtual) appliance as Panorama?

santonic · ‎10-14-2019

Even though 9.0.4 is already out I still don't recommend using this version in production. I've seen some really weird and annoying bugs on all 9.0 releases so far. I must say this is by far the buggiest release ever from PA.

santonic · ‎09-30-2019

Yeah, in the end I went for 2 VR option as well and it works well.

santonic · ‎09-11-2019

Good stuff! Thanx!

santonic · ‎09-09-2019

Yeah, only specific static routes (to, GW, Portal, maybe updates...) would work if the customer doesn't want backup default route over internet in case there are issues with VPN. And yeah, PBF is another way to go. Tho I think i would prefer the solution with 2 VRs. Thanx for your feedback.

santonic · ‎09-09-2019

I meant the initital default route for the remote location to get internet access and establish LSVPN connection to the gateway. After that the idea is to route all user traffic including internet traffic through VPN.

santonic · ‎09-06-2019

I want all satellites to route all traffic through VPN tunnel when it's available. In GP gateway if I leave Access Routes emtpy or if I publish 0.0.0.0/0 to the satellite I get the default route with metric 100 on the atellite. But that means the static default route entered on initial configuration of satellite will still remain the active route in forwarding table. And if we change metric on static default route (to more than 100) I guess the satellite will lose connectivity with GW gateway over outside interface? Anyone played with this scenario of routing all traffic from satellites? I guess I could add 2nd virtual router on satellites but seems overkill just for this.

santonic · ‎09-06-2019

On GP Gateway -> Satellite -> Route Filter you can filter which routes does GW accept and enter in its own routing table.

santonic · ‎08-26-2019

Yes, but we got this error when we set next hop to 'none'. In this case this check is irrelevant. But I think they fixed it as I didn't see it for a while now.

santonic · ‎08-26-2019

Output format: "aclIPVT_in_2; index: 2" { from INSIDE; source [ 10.200.10.116 10.200.10.115 10.200.10.110 10.200.11.0/24 10.200.10.113 10.200.10.112 10.200.10.117 10.200.10.111 10.200.10.0/24 10.200.10.114 ]; source-region none; to OUTSIDE; destination [ 10.140.1.15 10.140.1.10 10.140.1.20 ]; destination-region none; user any; category any; application/service [0:any/tcp/any/49152-65535 1:any/tcp/any/42 2:any/tcp/any/53 3:any/tcp/any/88 4:any/tcp/any/135 5:any/tcp/any/139 6:any/tcp/any/389 7:any/tcp/any/445 8:any/tcp/any/636 9:any/tcp/any/3268 10:any/tcp/any/3269 11:any/tcp/any/1025-5000 12:any/tcp/any/9389 ]; action allow; icmp-unreachable: no terminal yes; }

santonic · ‎08-25-2019

According to specs (from FW comparison tool: https://www.paloaltonetworks.com/products/product-comparison.html?chosen=pa-850,pa-220,pa-3220) PA-3220 should be able to have 10.000 security rules. The output is in xml format. They are making an internal app which will check all their firewalls for rules associated with certain IP.

santonic · ‎08-21-2019

@BPry I have a case where customer has over 5000 rules on PA-3220. And every time they try running command "show running security-policy" either from CLI or via API they always get only first 2664 rules?

santonic · ‎08-09-2019

Is Windows 10 image supported on any version of WildFire appliance? Maybe in PAN-OS 9?

Member Since	‎01-26-2011 05:56 AM
Date Last Visited	‎09-10-2024 02:05 AM
Posts	672
Total Likes Received	191

Online Status	Offline
Date Last Visited	‎09-10-2024 02:05 AM

About santonic

Re: Config Audit Failure

Importing (Cisco) switch configuration to Expedition

Re: Config Audit Failure

Re: Expedition - re-assign zones after change in routing

Re: Panorama management for Cloud NGFW

Re: Expedition - re-assign zones after change in routing

Re: Expedition - re-assign zones after change in routing

Re: QoS configuration based on destination (sub)interface on 3400 series

QoS configuration based on destination (sub)interface on 3400 series

Re: Can't generate output files

Re: Can't generate output files

Re: Browser not prompting/selecting client cert for GP portal

Re: Panorama management for Cloud NGFW

Re: App Identification and ALLOW rule - does this make any sense?

Re: What is PA equvalent to show Xlate to view NAT translations

Why is SMB traffic slow ?

Re: Expedition - re-assign zones after change in routing

Re: Panorama management for Cloud NGFW

Re: Why is SMB traffic slow ?

The World’s First ML-Powered NGFW

TAP in environments with asynchronous routing

Re: Changing master key on Log Collector within the same Panorama

Changing master key on Log Collector within the same Panorama

Re: PAN-OS 9.0 Released - Stop and Think

Re: All traffic through LSVPN (or LSVPN route metric)

Re: Rest calls from PowerShell failing

Re: All traffic through LSVPN (or LSVPN route metric)

Re: All traffic through LSVPN (or LSVPN route metric)

All traffic through LSVPN (or LSVPN route metric)

Re: LSVPN Satellite Deny specific subnet to Publish to gateway

Re: PAN-OS 9.0 Static Route Commit Warning

Re: can't able to get response for show running security-policy command from the device via SSH

Re: can't able to get response for show running security-policy command from the device via SSH

Re: can't able to get response for show running security-policy command from the device via SSH

Re: Is there an ETA to when Windows 10 will be supported by Wildfire?

Nebula Hardware Beta

Nebula Beta

Unlock your full community experience!

About santonic