About johnwalshaw

I just updated and found that it resulted in a slow boot loop. Would be forwarding traffic for approx 2-3 minutes and then reboot and all things related to coming up would take apox 8 minutes (traffic forwarding outage). So I rolled back to the pre-update snapshot. Didn't have time to look into it. It boot looped three times before I rolled back.  I was coming from 10.1.3 with stability / uptime of 152 days.  I'll do some research or wait for the next P version and possibly some release notes that speak to this boot loop issue. ... View more

How do you have path monitoring configured? Maybe post a screenshot similar to what I posted? ... View more

Also, forgot to mention that I have each ISP on a separate virtual router, therefore there is no backdoor zero route possibility via another ISP link. The result is that path monitoring to specified internet destinations is working without fault. ... View more

I'm re-reading the thread and love that you have a script to harvest the gateway IP from the DHCP interface. The issue of your lease expiring is interesting as that should renew at the lease half-life.  That is the problem I would perhaps think about.  The process to trigger (schedule) the lease renew might be worth looking at. But is this an ISP issue at the core also?  Regarding what the target is that you ping, there might be an opportunity there.  Here is my config as feel it is representative of the internet.   ... View more

I have tested DNS proxy on Palo and it worked great.  I have not investigated the log detail. ... View more

For the DHCP interface you should uncheck the option to auto create default route. This is because the static route monitoring is for a static route, not for an auto generated route.  Therefore, once you uncheck the option to auto create default route for DHCP interface, you need to create a static route to the ISP gateway IP.  Only issue is that if the ISP ever change the gateway IP, your static route would become invalid. ... View more

I literally just configured this.  I have the default virtual router and then a separate virtual router for each ISP (hub and spoke). With this method, you can prevent the dedicated ISP virtual routers having a zero route to the other ISP.  Therefore path monitoring will have the desired effect to flush the zero route for that specific ISP. You need to create a loopback on each virtual router.  Then create static routes (hub and spoke) to each ISP router (requires loopback). You can then configure eBGP on those links, along with redistribute. The method I used was local pref on the internal (default) virtual router to designate primary and secondary ISP.  The failover is tuned to 3 seconds and then hold time of 2 minutes for fail back. PDF with screenshot can be found here, although this is not a how-to guide, it will give you some of the main concepts.   https://www.linkedin.com/feed/update/urn:li:activity:6869729830720688128/ ... View more

Keep in mind that DHCP is a conversation that happens before there is an IP address assigned, so the concept of a session might be different. I have not tested this on Palo myself. Maybe add both zones on the source and dest. My experience was Cisco ISR ACL and that was quite interesting.   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFXCA0 ... View more

Something else to keep in mind is that VM-50 is fully licensed, so if you go for lower throughput, there are more options out of the box. ... View more

Agreed and understood.  I updated my original post. I have tested DDNS successfully now.  Seems like a weird method considering there is a default CA store, which is inexplicably unavailable for a public internet public CA URL. ... View more

I originally tested without Cert Profile, thinking that PAN would use the the default Internet CA store, but this is not an option. You literally need to download and install the root CA (and intermediate) on PAN, which I think defeats the purpose of PAN-OS having a default CA store.  Once you have installed the root CA, then create a cert profile and add the root CA (and intermediate if applicable). I called it cert_profile_1 as I assume I would add more root CAs for other things in the future.  You do not need to add the web site cert. So all should be good unless the web site changes to a different root CA. It would be great if PA has the option to 'use default cert store' instead of an explicit cert profile. ... View more