About HULK

Ok. Once you will provide the session details, we may give you some more insight. Thanks ... View more

Hello Infotech, As per the output: Session           61416         c2s flow:                 source:      172.17.1.5 [DR-DMZ]                 dst:         199.169.208.252                 proto:       17                 sport:       500             dport:      500                 state:       ACTIVE          type:       FLOW                 pbf rule:    Fedline 12  >>>>>>>>>>>>>>>>>>>> traffic going through PBF rule         s2c flow:               start time                    : Mon Aug  4 15:10:55 2014         timeout                       : 600 sec         time to live                  : 594 sec         total byte count(c2s)         : 2648352         total byte count(s2c)         : 0 >>>>>>>>>>>>>>>>>> no packer received from Server-to-client flow         layer7 packet count(c2s)      : 9008         layer7 packet count(s2c)      : 0 >>>>>>>>>>>>>>>>>>>>>>>>>>>>>         vsys                          : vsys1         application                   : ike         rule                          : Rule 6 >>>>>>>>>>>>>>>>> security rule         session to be logged at end   : True         session in session ager       : True         session synced from HA peer   : False         address/port translation      : source + destination         nat-rule                      : Fedline_DR(vsys1) >>>>>>>>>>>>>>>>>>>>>>>>>> traffic is getting NAT'd in PAN firewall, Hence, make sure, NAT-traversal is enabled on both side VPN gateways.                ingress interface             : vlan.999  >>>>>>>>>>>>>>>>> packet incoming interface         egress interface              : ethernet1/3 >>>>>>>>>>>>>>>>> packet outgoing interface.         session QoS rule              : N/A (class 4) admin@PA-3020_DR> Hope this helps. Thanks ... View more

Hello Harshit, Few related information for you: Cisco Link Aggregation Traffic Through a PAN Device Which Link Aggregation Protocols are Supported? LACP LAG LACP support Hope this helps. Thanks ... View more

Ok, then nothing has to be done on the PAN firewall apart from a general security policy etc. You can check the real time session in the CLI by using 'show session all filter source IP_ADD_OF_THE_TESTING_PC destination IP_ADD_OF_THE_DESTINATION'. >  If there is a session exist for the same traffic,  then please apply  CLI command PAN> show session id XYZ   >>>>>>>> to get detailed information about that session, i.e NAT rule, security rule, ingress/egress interface etc. Thanks ... View more

Is the VPN tunnel configured with PAN firewall or it's just a pass through device..? Thanks ... View more

is the VPN terminates on PAN FW...? Thanks ... View more

You need to configure a specific route through VPN tunnel ( based on destination) and a default route for all internet traffic. The PAN firewall will search for a longer match first ( through the tinnel). Thanks ... View more

If NAT-T is not enabled on PAN firewall, then could you please let us know, why are you expecting traffic on port 4500..? Thanks ... View more

Hello Jrussell, Could you please verify below mentioned information. --- destination device is having a valid return route, to send back the traffic. --- Please verify, if there is a session available for the traffic on the APN firewall. > show session all filter source IP_ADD_OF_THE_TESTING_PC destination IP_ADD_OF_THE_DESTINATION'. If there is an session exist for the same traffic,  then please apply  CLI command PAN> show session id XYZ   >>>>>>>> to get detailed information about that session, i.e NAT rule, security rule, ingress/egress interface etc. It will also show you the number of packets has been received and transmitted. Thanks ... View more

Hello Infotech, Please make sure NAT-traversal is enabled on both side firewalls to accept IKE on port 4500. During IKE negotiation, 3rd message onwards, port will flip to UDP 4500. Traditionally, IPSec does not work when traversing across a device doing NAT.  To circumvent this problem, NAT-T or NAT Traversal was developed.  NAT-T is an IKE phase 1 algorithm that is used when trying to establish a VPN between two gateways devices where a NAT device exists in front of one of the devices. Thanks. ... View more

Hello Roman, Please check this link: Disable Password Saving in Web Browsers - IS&T Contributions - Hermes Is this issue related to Palo Alto firewall..? Thanks ... View more

Hello Roman, Although, the issue is not related to PAN firewall, adding a link for you, it might help you for the same. Usernames and passwords are not saved | Firefox Help Password manager - Remember, delete and change saved passwords in Firefox | Firefox Help Thanks ... View more

Hello Tharpham, I still hope this feature is not yet implemented in currently available PAN OS.  Reference discussion: Re: QoS on Tagged VLAN Sub-interface Subject: Sub-interface based QoS on PA-5000 Priority: High FR ID: 1768 Subject: QoS Bandwidth Policing Priority: High FR ID: 2475 For questions like these, it's best you reach out to your SE or sales contact. He might give you some more insight. Thanks ... View more

Hello Slv, it could be an issue with web-GUI. Could you please run below mentioned command to verify the previously installed 2 database version: > request content upgrade info Do you have a chance to restart the device-server process (preferably after the business hours) and verify the result. Thanks ... View more

As per my understanding, It's only relevant if you have multiple IKE policies. The lowest numbered one is checked first. If it matches the IKE properties (policies) on the other end, it's used. Otherwise, it moves down the priority list to see if the other policies match. Related Cisco Disciussion: https://supportforums.cisco.com/discussion/11254861/question-related-ike-policy-priority Thanks ... View more