About robmaas

Sorry for the bump, but it might help others.    I stumbled upon the exact same problem, the problem in this case was that the certificate/key were automatically renewed on the server. This is quite common when using Let's Encrypt with ACME (http-01 or dns-01) challenge.    When getting this error make sure to check if this is the case.    In these cases it makes sense to automate the renewal of the certificates on the firewall with the API, as an example. curl -k -X POST -F "file=@server.key" "https://1.2.3.4/api/?key=xxx&type=import&category=private-key&certificate-name=server.com&format=pem&passphrase=xxx" curl -k -X POST -F "file=@server.crt" "https://1.2.3.4/api/?key=xxx&type=import&category=certificate&certificate-name=server.com&format=pem"   ... View more

Sorry for this bump, but another use-case are cloud deployments with active-active firewalls, which require a source-nat to keep the traffic symmetric. A variable like ($srcip) instead of ($user) would be helpful and eliminate the need of a proxy like the Azure AppGW in front of the FWs for this functionality. ... View more

Unfortunately I wasn't able (anymore?) to edit the above comment.   However I managed to setup the BGP peering, but GCP won't redistribute imported VPC peering routes automatically. Is this something that can be changed, without the need to add them as custom routes to the redistribute profile of the cloud router ? ... View more

Is there already some documentation about how to set this up, especially topology 2(b) ? ... View more

I like this, although I would prefer an IPS, however, this is non-intrusive and an easy to implement feature, it would give good insight in what is happening.   Is there also a 'best practice' on how to coop with encrypted traffic, since most of it will probably be encrypted till the host/app. ... View more

Sorry to kick an old topic.   But indeed it would be nice to have an option to make exemption(s) for a certain hash(es). I think you really want it on hashes in case a file changes. ... View more

Sorry it is over a year, but I think this is still a relevant problem.   I wasn't able to get this working with the PAN FW, but a solutions (or maybe more a workaround) is to use an Avahi Reflecter. You basically setup a VM with multiple interfaces, depending on where you want your traffic to go. This VM basically receives the mDNS traffic and will repeat it over the other networks.    Make sure to tighten the VM to only accept mDNS traffic, so it won't become a rogue router. Also if you have Apple devices, make sure to turn of caching.   There is a lot of information to be found about this on the Internet, i.e.: http://chrisreinking.com/need-bonjour-across-vlans-set-up-an-avahi-gateway/       ... View more

The Portal will inform the client of the available gateways. The client will then connect with one of the available gateways, therefore Azure LB is not necessary for this to work. ... View more

@junior_r wrote: @Warby wrote: Hello,   The easiest way to synchronize polices on multiple Palo Alto Networks firewalls is to use Panorama (our management station) to push policy.  This works for all of our physical and virtual firewalls.  Config elements can be shared or completely independant by device groups.   Another option is to use a thrid party tool like Ansible to push configs to multiple firewalls.  We have some sample Ansible plabooks available: https://live.paloaltonetworks.com/t5/Ansible/ct-p/Ansible   The VM-Series firewalls can terminate IPsec tunnels very well.  The decision to use the VM-Series versus the Azure VPN gateways should be based on the architecture, routing, performance, etc.   HTH, Warby   Hi Warby,   Thanks for the reply the client don’t have Panorama. I guess I will explore the Ansible playbook route. If I have multiple FWs on Azure how would I create the IPSEC tunnel from high level? Wouldn't External LB Break the IPSEC tunnel? I could use multiple public IPs and tunnel monitor but that would mean only one tunnel will be up at a time. Also what is the performance impact of PAN IPSEC tunnel VS Azure VPN Gateway? What about Global Protect? Would it work with External LB? Would you assign two GP pools? One for FW1 and one for FW2 so the destinations know which firewall to return traffic to?       Thanks   I would connect the IPSEC tunnel(s) directly on the firewalls. If you have multiple firewalls within Azure, with the same back-end, you can use OSPF and ECMP to utilize both tunnels.   For GP I would use the same approach and terminate the GP GW directly on the firewall and only put the GP Portal behind the LB. ... View more

Due to the nature of Azure networking, another loadbalancer won't probably fix this problem. When using another LB solution and making this HA, you probably going to need a Azure Internal LB. See this reference documentation: https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/dmz/nva-ha   I created a feature request at MS, you can upvote. https://feedback.azure.com/forums/217313-networking/suggestions/31116808-loadbalancer-multiple-ports-in-one-frontend-rule   A (dirty) work-around can be using multiple internal loadbalancer, as far as the client doesn't use over 150 ports (the limit is actually 150).   Unfortunately no (real) solution, but hopefully it will clear things up. ... View more