About Raido_Rattameister

Raido_Rattameister · ‎10-15-2015

Ideal solution would be to configure vlan's on switch, place diferent workstations to seperate vlans with seperate IP subnets. If you can't change ip addresses of your machines then you can change interface ses to Layer 2 mode. Lets say ethernet 1 is internet zone, ethernet 2 is L2-it-department zone and ethernet 3 is L2-finance zone. Then Palo interfaces 2 and 3 act like switch but you can create firewall rules between them. There is some more complexity involved (like getting connectivity between L2 and L3 zones to access internet etc) but it is doable.

Raido_Rattameister · ‎10-15-2015

If you really want then you can configure firewall on Layer 2 also with Palo. Then it works as a switch. You have Layer 2 zones and you can create rules between them. All machines can be in same ip range. In this case no need to change ip addresses. You never design this from scratch but if environment is place then it can be used as workaround. Throwing out google search link so you can check if this is something you need. https://www.google.ie/webhp?sourceid=chrome-instant&ion=1&espv=2&ie=UTF-8#q=palo+alto+networks+firewall+layer+2+deployment

Raido_Rattameister · ‎10-15-2015

Can you explain more what is your goal? You can allow or block traffic based on source ip or source user. Palo can't throw packets into diferent vlans based on soure mac address.

Raido_Rattameister · ‎10-15-2015

Do you want users behind Palo to browse web over both ISP's or have web servers behind Palo that are accessible from internet? Starting from v7 Palo supports session based ECMP https://paloaltonetworks.com/documentation/70/pan-os/pan-os/networking/ecmp-load-balancing-algorithms.html And you can use BGP but Palo is not full blown BGP router so you can't have all internet routes there.

Raido_Rattameister · ‎10-15-2015

Firewall (or dataplane) restart will restart counter. When traffic matches rule at least once after reboot then it shows up as used rule. When rule has not matched starting from last reboot rule shows up as unmatched rule.

Raido_Rattameister · ‎10-14-2015

Can you set vpn on Palo into passive mode and initiate vpn from other side? System log on Palo shows pretty exactly at what state vpn fails.

Raido_Rattameister · ‎10-14-2015

To be more specific - this counter is reset when dataplane is restarted not full firewall.

Raido_Rattameister · ‎10-14-2015

Hi, with v7 you can have GP to assign static ip's. https://www.paloaltonetworks.com/documentation/70/pan-os/newfeaturesguide/globalprotect-features/static-ip-address-allocation.html Do you mean that after users connect to GP they have to join workstation computers to domain? Domain joined computers should update their DNS records correctly themselves so it should not be an issue after workstation is domain joined already. DNS server can be configured to trust DNS record updates from non domain joined computers aswell but if you configure this then anyone can spoof your dns records and not good idea 🙂

Raido_Rattameister · ‎10-07-2015

Yes it shows application in repots. Can you send screenshot of your report configuration? Don't have v5 around to test. Any reason you don't run newer version?

Raido_Rattameister · ‎10-05-2015

When I have had issues with GP reinstall then it has always helped when I deleted its folder from Program Files and went through registry (start > run > regedit) and deleted all globalprotect entries.

Raido_Rattameister · ‎10-05-2015

Yes it should. Is your vpn tunnel interface in dedicated zone? What do you see if you filter Traffic log with following filter (change vpn zone to the one your tunnel interface is in)? ( zone.src eq vpn-zone ) and ( app eq dhcp)

Raido_Rattameister · ‎10-05-2015

Hi, If you set ip-helper address on cisco it should forward dhcp request to this ip. Do you see dhcp packets coming from zone your vpn tunnel interface is set to? Information about DHCP relay https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-a-DHCP-Relay-on-Palo-Alto-Networks-Firewall/ta-p/59544 But you probably don't need to set relay on Palo as ip-helper should be unicast not multicast traffic so there is destination IP set to your destination DHCP server already. Cheers, Raido

Raido_Rattameister · ‎10-05-2015

Hi, Is this traffic to other Lync/Skype clients or to MS servers? List of MS servers can be found here: https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-Us#BKMK_EXO Cheers, Raido

Raido_Rattameister · ‎10-05-2015

Hi, If you have single URL category then go to: Objects > Security Profiles > URL Filtering Click on URL filtering profile in use and check what is blocked. You can do same on Policyes > Security to see what you allow or block. If you have big ruleset then Monitor > Manage Custom Reports will come handy. There you can run custom reports to see what URL categories are blocked for user traffic and what application are permitted/denied. Cheers, Raido

Raido_Rattameister · ‎10-05-2015

One option is to use client side certificates. If you want users to be able to log in only from corporate laptops then just push client certs from AD Cert authority with Group Policy.

Member Since	‎02-10-2015 12:44 AM
Date Last Visited	‎05-03-2024 05:26 AM
Posts	1,436
Total Likes Received	480

Online Status	Online
Date Last Visited	‎05-03-2024 05:26 AM

Unlock your full community experience!

About Raido_Rattameister