About mrajdev

mrajdev · ‎11-15-2011

Mcue, This issue is targeted to be fixed in 4.1.1. Thanks

mrajdev · ‎10-14-2011

Jeff, TCP sequence number checking is enabled by default.You can turn it off if you wish using the command above. Thanks

mrajdev · ‎09-26-2011

Ron, You have to make sure the Layer 2 path and then Layer 3 reach ability is there between the L3 interface on PAN and the next-hop router. Depending on how many times the packet originating from the PAN L3 interface will traverse the PAN through the L2/Vwire interfaces, you need to ensure there is a policy between the two zones (ingress and egress zone) is present. Hope this helps. Thanks

mrajdev · ‎09-24-2011

Roh, Based on the image you have uploaded seems like the license is getting expired in Oct and you are getting the license expire log messages one month before the expire. Can you please confirm that license on this device is valid till Oct? Thanks

mrajdev · ‎09-24-2011

Check to see if you have a multi-hop option on the PAN, If you do change the multie-hop to 2 on both sides, Then you should be able to do BGP to loopback. Hope this helps.

mrajdev · ‎09-22-2011

Ron, I think you will be fine based on the info you provided.

mrajdev · ‎09-22-2011

You are correct. The IP address on the L3 inteface needs to be different subnet from the mgmt interface. You should not have an impact on the firewall functionality unless you have a lot of VPN traffic and VPN tunnels. The 2050 will be able to do both Vwire and VPN termination, assuming you are not already at the max limit of the 2050 packet handling.

mrajdev · ‎09-22-2011

Hi, To answer your question you can have a mix of Vwire and L3 interfaces on the PAN. So you can add a few sub-interface on one of the ports and configure L3 for those sub-interfaces and terminated the VPN on one of the sub-interface. You need to make sure there is reachability from the L3 sub-interface to the remote end VPN peer IP address. Hope this helps. Manish

mrajdev · ‎09-22-2011

Sunil/Alex, I would request you to please contact your sales team from Paloalto networks to put in a feature request for your scenario. Thanks

mrajdev · ‎09-22-2011

Not sure what you mean when you say QoS Max hit. Can you give a quick example of your QoS profile so that we can provide you with an accurate answer. Thanks

mrajdev · ‎09-21-2011

1) The commit times of 4 to 5 mins is ok. There is no hardware issue, if the config is small and there is no change then the PA-500 might get the commit done in 30 seconds. 2) When you downgrade to 3.1.10. If you had certs in 4.0 then the cert from the config is no longer there, that is one of the reason why the auto commit will fail after the downgrade. Auto commit will keep trying to commit successfully and will try it for 6 times before it fails. You can do a show jobs all and show job id <job id> number to find the reason of the auto commit failure. Load the ssl-cert if you had this in the config on 4.0 and fix any another other reason for the commit failure. After this the device should work fine. If you need help then please call PAN support. 3) You should open up a support case to check on the crash issue. 4) There is no SSD on PA-500.SSD are only on the PA-50X0 series device. Hope the above helps. Thanks

mrajdev · ‎09-20-2011

One more thing I wanted to confirm was are you using two ports to connect the two VR on the same device? If not then you will have to use two ports to connect the VR externally or this will not work. The two VR will need a physical interface to send out the packets.Do please let us know if this helps resolve the issue.

mrajdev · ‎09-20-2011

Just wanted to confirm, so you are doing BGP between two IP addresses in which each BGP peer resides on a difference VR, each VR is in difference Vsys on the same device, correct? For checking the session are you inside the vsys to check the session? If you are in the vsys, have you checked by going into both the vsys to check the session? I would suggest to use the CLI to check the session. Please let us know on the above. Thanks

mrajdev · ‎09-20-2011

Hi Andrey, Can you please open up explorer, navigate to the directory where the PAN-agent software has been installed. Once you are there, can you please select the .exe file, right click on it and run as administrator. This should resolve the issue you are seeing. Please let us know if this works for you. Thanks Manish

mrajdev · ‎09-13-2011

Aj, Seems like you management server is using a lot of memory. You can restart the management server using the command "debug software restart management-server". Also would suggest you to upgrade to the latest release of software so that the issue does not reoccur. Hope this helps. Thanks

Member Since	‎02-25-2011 04:42 PM
Date Last Visited	‎04-05-2024 08:09 PM
Posts	95
Total Likes Received	19

Online Status	Offline
Date Last Visited	‎04-05-2024 08:09 PM

About mrajdev

Re: HA A/P: BGP routes synchronzation

Re: IPsec VPN tunnel cant ping eachother

Re: Port 4500 ipsec/udp traffice

Re: BGP RIB-out prefix

Re: VPN and client proxy

Re: Unable to download Dynamic Updates/

Re: BGP RIB-out prefix

Re: VPN Client issues

Re: Unexpected Incorrect filtering

Re: P-bit in type-7 LSA. OSPF NSSA.

Re: admin password not reset to default

Re: BGP RIB-out prefix

Re: CLI error when "show system statistics"

Re: Problems when changing IP address of trusted networks' interface

Re: manage standalone or in panorama

Re: password recovery

Re: IPSec Authentication with IOS 5.0 or Shrew Soft VPN (XAuth)

Re: Check TCP sequense number

Re: VPN for multiple internal subnets?

Re: When do PA alert for expiring license on system log before license expire?

Re: inter vsys BGP routing

Re: VPN for multiple internal subnets?

Re: VPN for multiple internal subnets?

Re: VPN for multiple internal subnets?

Re: HA - Link Monitoring

Re: Traffic flow when QoS max hit

Re: Firewall Roll back interface lights go away

Re: inter vsys BGP routing

Re: inter vsys BGP routing

Re: Is PAN-agent supported for win7?

Re: CLI error when "show system statistics"

Unlock your full community experience!

About mrajdev