About dept_tec_bcn

dept_tec_bcn · ‎09-18-2013

This is our scenario: - A PA-200 with a subinterface tagged with VLAN ID 200. - Connected to a Cisco Catalyst switch (trunk with VLAN ID 200 allowed). - It has been working without problems. Now, we want to divert traffic to a Cisco router with same IP address as PA-200. We put Catalyst interface in shutdown state (where PA-200 is connected) at 10.52h. - We can see interface in "down" state (red) in PA-200. - We cannot ping this interface IP. - There's no other interface in this security zone. But, traffic log is showing that there's some traffic in this interface. How is it possible? I attach some pictures. Thank for your answers!

dept_tec_bcn · ‎07-02-2013

Thanks, it is just what i need.

dept_tec_bcn · ‎07-02-2013

Hello, I had been trying to get that information (Time a user has spent surfing in a URL) with no succeed. I am looking for extra information in the forum. Any news about that topic? Thanks in advace for the support. Sat.Cat.

dept_tec_bcn · ‎09-19-2012

Yes, good idea... I'll try it. But it would be great that PA could track routes for dynamic routing; PBF is very useful, but not enough for this kind of scenarios.

dept_tec_bcn · ‎09-17-2012

Hi all, I have the following scenario: CPD 1: Internet ISP1 -- PAN1 -- ROUTER1 CPD 2: Internet ISP2 - PAN 2 -- ROUTER2 And a layer 2 connection between CPD1 and CPD2 (in different locations). Initially, there were only router1 and router2 (with their respective ISP Internet connections) with OSPF area 0; now, I've added a PAN device to each CPD, including them in OSPF area 0, but not in HA. My first idea was to: - Each location uses their ISP internet access, located in the same building. - In case of failure, a location will use the other ISP internet access, using OSPF routing. These scenario could be possible if the failure point are the PAN devices. But if the failure is in any of the Internet ISP routers (not talking OSPF and controlled by the ISP provider), how can I modify the OSPF path costs to use the other ISP router? Is there any possibility of OSPF track?

dept_tec_bcn · ‎03-13-2012

Thanks for the answer, but what i really want to know if there is any historic of the throughput, sessions and cpu usage. I don't know if i have a PAN device connected in tap mode during 1 week and i want to know the maximum concurrent sessions, througput or cpu usage it had during this week. I could no find something like that in custom reports. Any idea? Thanks in advance.

dept_tec_bcn · ‎03-12-2012

I need to know if there is any report/graf in PA that shows the throughput peak, simultaneus session peak, in a custom time period. This would be great for sizing equipment after analizing the traffic of a costumer during some days. It will be very usefull to know how are you using your equipment and the grow prosibilities you have. I have been looking in PA reports and found no information about throuput, session, cpd usage peaks. Thanks in advance for your help. Albert

dept_tec_bcn · ‎02-15-2012

No, that's not possible because of the scenario. In this scenario, there are some networks that are sharing the network hardware but are isolated in a VLAN. We don't know which DNS configuration they have, but we want that if they need to access to certain web pages, the DNS resolution points directly to our DMZ instead the public IP address. I know which PA interface they're using, the network adresses for this VLAN and the domains I need to proxy, but I don't know the DNS configuration (could be any public server); so I need to intercept their DNS requests to mydomain.com and resolve them with my internal DNS servers. Is this possible? Thanks!

dept_tec_bcn · ‎02-15-2012

Hi all, I've read in an article that it's possible to intercept DNS requests with DNS proxy without setting PA IP address as the computer DNS Server. Following this article, I've enabled DNS proxy in a PA interface (inside), redirecting DNS request to a public DNS server; I've set up a DNS proxy rule to try to intercept the requests (for example, *.google.*) and created a DNS static entry like this: www.google.es --> 1.1.1.1 But if I set up a public DNS server in my computer (8.8.8.8 or any other) the DNS request are not intercepted, only if a set up the PA interface IP as my DNS the DNS requests are resolved as I want. Is there anything wrong in my configuration? Or DNS proxy interception isn't really working?

dept_tec_bcn · ‎01-17-2012

Now there is no license error but the vpn-ssl does not connect. I have only one portal with only one IP address and I have no Internal Gateway only an External Gateway. Also I have not HIP profiles.

dept_tec_bcn · ‎01-13-2012

I have a problem with global protect without license i have configured it as in tech notes says, but when i commit i get the following message. •Warning: No valid GlobalProtect portal license!(Module: useridd) When i launch Global Protect Client it not connets. In GlobalProtect Client I get the following Logs. (T4988) 01/13/12 15:36:45:998 Error(8084): gethostbyname failed: 11004, host 84.88.XXX.XXX (T6984) 01/13/12 15:36:48:250 Error( 281): Server Error: Connect to 84.88.XXX.XXX:443 Failed (T6984) 01/13/12 15:36:48:250 Error( 135): do_tcp_connect() (T6984) 01/13/12 15:36:48:250 Error(3664): ConnectSSL: Failed to connect to ' 84.88.XXX.XXX:443'. Disconnect ssl. (T4988) 01/13/12 15:36:48:299 Error(6788): NetworkDiscoverThread: failed to discover external network. And in System Monitor of PAN device i got the following filtering by ( subtype eq globalprotect ) subtype : globalprotect severity: informational Event: globalprotectportal-config-succ Object: portal-tunnel.1 Description: GlobalProtect portal client configuration generated. Login from: 213.97.XXX.XXX, User name: user1, Config name: default-user-config. subtype :globalprotect severity: informational Event: globalprotectportal-auth-succ Object: portal-tunnel.1 Description: GlobalProtect portal user authentication succeeded. Login from: 213.97.XXX.XXX, User name: user1. No news from Gateway.... Your help will be apreciated. Thanks in advance. Albert

dept_tec_bcn · ‎11-15-2011

Hello all, We have a similar issue. Our problem is that many WIFI users cannot get the Captive Portal web. If we try many times with luck the Captive Portal finally apears (sometimes in 10 minutes sometimes more than on hour later!!!!, sometimes no succeed), the strange thing is that the same user with the same computer can have the problem today and not tomorrow. Once the computer succeds in connecting it can connect and disconnect without problems during the day. But perhaps tomorrow could or not find that problem. (We have the problem with all web browsers) We are having this problem with lots of users, and because it randomly appears it is difficult to locate the real issue. We have two 2020 PAN devices in HA Active/Passive in PANOS 4.0.3. The Captive Portal is in transparent mode. Any Idea? We have checked all the net Wifi controller, Switchs, etc. All seems to be ok. Tomorrow i will try to configure redirect mode for Captive Portal but i have no many good feelings with that. Thanks in advance for your help/support. Albert

dept_tec_bcn · ‎11-11-2011

Hello i need some help. I need to know the URL that PaloAlto device uses to redirect Captive Portal. I supose should be something like: http://<PAN_ipaddress>/xxxxxx.xxx Thanks in advance for your help, Albert

dept_tec_bcn · ‎11-07-2011

Hello, I am trying to enable SSL-VPN with a PPPoE interface but I can not see the SSL Portal. I have configured on the pppoe interface the static IP address and check the box of add default route. I have configured the SSL-VPN with a tunnel interface and output interface ethernet-pppoe and with his static ip address. Also I opened the https service on the outside zone. Now I can see in traffic allowd in the monitor the SSL request to the public IP of PPPoE but I can no see the SSL Portal. Could someone help me? Regards,

dept_tec_bcn · ‎07-12-2011

Hi, after doing an upgrade from 4.0.1 to 4.0.3 the candidate config fails due to incompatible app used at PBF. Where can I find the compatible app with PBF? There's no way to use custom app with pbf? Thanks, Robclav

Member Since	‎01-31-2011 05:37 AM
Date Last Visited	‎12-18-2023 11:53 AM
Posts	19

Online Status	Offline
Date Last Visited	‎12-18-2023 11:53 AM

About dept_tec_bcn

Traffic logged in an interface in down state

Re: Url report based on total spent time

Re: Url report based on total spent time

Re: OSPF between PAN devices

OSPF between PAN devices

Re: Sizing PA Devices

Sizing PA Devices

Re: Intercept DNS requests

Intercept DNS requests

Re: GlobalProtect without license on 4.1.1

Traffic logged in an interface in down state

Re: Url report based on total spent time

Re: Url report based on total spent time

Re: OSPF between PAN devices

OSPF between PAN devices

Re: Sizing PA Devices

Sizing PA Devices

Re: Intercept DNS requests

Intercept DNS requests

Re: GlobalProtect without license on 4.1.1

GlobalProtect without license on 4.1.1

Re: IE8 and captive portal

Captive Portal URL

SSL-VPN using PPPoE PANOS 4.1

APP limitation using PBF

Unlock your full community experience!

About dept_tec_bcn