About Metgatz

Question on aws vm series ipsec tunnel ip /30 Tunnel interface   Hello Livecommunity, how is it going? I hope it's going well     I have a doubt, thinking in vmseries on Amazon, where from the virtual stick arme several ipsec tunnels site to sire either onprem or towards on prem or not, thinking in the typical network /30 for what is the tunnel interface interfaces, there at the level of aws vpc should I create more overweight for each vpn, a AWS subnet for all Tunnel Interface VPN nets  ? For that communication to work or how is there the point because I get confused.   On prem ipsec vpn ok /30 both ends cok correct ip and we already ping each other as usual that all good but in aws vmserie like that there the issue in the vpc I have to do subnet /30 for each tunnel I use like that, that is subnet in the vpc ?   What about HA on different Az using secondary IP .... Has anyone had experience, comments or anything with this point ?   Thank you in advance for your time, support and collaboration   Best regards ... View more

Anyone with exp in PAN-OS SD-WAN without panorama for VPN S2S Dual ISP ?   Hi Live PAN-community, how's it going ?   Does anyone have operational functional experience of pan-os sdwan ( firewall sdwan without panorama and without cloudgenix appliances ) deployments operating and running sites with two ISPs for IPSEC S2S VPN connections.   Today we have operating only pan-os sdwan for internet outbound, with 2 unified links, operating well, however with limitations but it works and good well.   Now thinking of moving to VPN S2S using pan-os sdwan scheme, anyone has experience of deployment in their environments ? if it operates correctly ? Points, tips, points to focus on, recommendations, headaches, etc. If you have had any unexpected problems, what has been your feedback, your experience operating between HQ to VPN S2S branches of at least 5, 10 or more pan-os sites between your PANW firewalls of branches against the HQ.   Please only people with sdwan exp, from their pan-os licensed firewalls who have real experience without using Panorama, where the deployment is not the best, but it is valid, functional, operable with the important limitations, of course, but functional.   Thank you for your kindness, kindness, your time and collaboration   Best Regards ... View more

SAML - Integration - Globalprotect Azure-AD-EntraID  - Policy Based Groups Azure-AD for GP   Hello Live community, how's it going? I hope it's going well.   I have a question, today we have via GP the integration with Azure-AD Entra ID, via SAML, where everything works correctly.   At the level of what is the assignment of groups, we already assigned several groups in the enterprise application, where you read who or who can log in via GP, now the big question.   Is it feasible to make group based policies, ie: GP source zone - destination DMZ01 Azure Source Group: IT01 I.e. Azure Group-AD IT01@contoso.com , another with SEC01@contos.com Infra@contoso.com.   This to avoid having to make policies, user, by user, to reach and filter the destinations.   Is this feasible ?   There is no AD-Onprem.   Thank you I remain attentive   Best regards ... View more

HA Condition - Link Monitor Recovery - Time to retake Active Link Monitor role   Hello Community, how is everything going, I hope it's going well.   I have the following questions regarding HA.   Details of the environment. Active - Passive A/P Principal PA - PA-52XX-01-HA - Priority 50 Secondary PA - PA-52XX-02-HA - Priority 100 Preemtive active Link State Passive - Auto Link monitor interfaces eth1/1 - eth1/2 - eth1/3 - eth1/4 - in VWIRE mode ( If "any" fails apply failover ).   We understand that when there is a restart of the PA-01 firewall, priority 50, the role is assumed by the PA-02, after the main firewall restarts, because of the preemtive value, it waits for 1 minute and takes control again.   Now I have the following doubt, I will describe the specific situation:   PA-01 active, two interfaces fail - PA-02 assumes active role ---- Operates a few minutes on Secondary PA-02 with active role all good. It recovers from the failure condition of the two interfaces. How long does it take to assume the role again, once it has recovered from the failure condition? I understand it is immediately under the Promotion Hold Time (ms) timer 2000/500 ms.   Now if it is 1 minute, like the example of the restart, is it possible to recover the role immediately, that is, the failure condition is recovered, the failure condition of the Link Monitor is restored and that it does not wait a minute, but immediately, adjustable or as fast as possible the PA-01 of HA Active resumes the role ????   Detail Doc HA timers Info: Promotion Hold Time (ms) Time that the passive firewall (in active/passive mode) or the active-secondary firewall (in active/active mode) will wait before taking over as the active or active-primary firewall after communications with the HA peer have been lost. This hold time will begin only after the peer failure declaration has been made. 2000/500. Preemption Hold Time (min) Time that a passive or active-secondary firewall will wait before taking over as the active or active-primary firewall. 1/1   Thank you very much for your kindness, cooperation and your time.   I remain attentive   Best regards ... View more

USER-ID log from VPN Cisco concentrator   Dear Live community, how is everything going ?   Have you ever had to do the following?   We have to integrate a Cisco ASA, with Palo Alto, so that the PA receives from a Cisco ASA and/or Cisco ISE the users to be able to have mapper with USER-ID the users that connect by VPN. ( There is no global protect )   Details: Cisco ASA --- Cisco ISE ( AAA ) users with any connect - Flows through PA.   They want the Palo Alto firewalls to be able to read the users that when a user connects via VPN to the Cisco ASA, the Palo Alto FW receives the information from the Cisco ASA and/or the Cisco ISE on the PA, so that the User-ID can somehow get that information from those users.   Clarifications, the PA does not have and should not use Global Protect. The Palo Alto FW must receive the information from the Cisco ASA and/or Cisco ISE when VPN users connect, Palo Alto can map them and see them in the User Log fields of the PA when traffic passes through it.   Please can you guide me and/or indicate me how to achieve this goal, at least as a base, limitations, considerations and/or guide to achieve this issue.   Thanks for your time and collaboration   I remain attentive   Best regards ... View more

Global protect Always On - External connections   Hello LIVE community!   I hope you are well.   I have had to configure Global Protect on several occasions but I have a question that I am being asked in this case: Is it possible in S.O windows to use the Always On, filtering that only connects to GP when it detects the connection in an External way, home-office, cafe, client offices,etc, but when it is in the HQ, it does not connect to GP.   Is it feasible and what would be the important recommendations to consider to implement it?   Thanks   I remain attentive   Best regards ... View more