About Metgatz

Hello @maniac72    I think you have a little wrong concepto to apply NAT in Palo Alto. I suggest review this links:   https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/networking/nat/nat-configuration-examples    https://www.packetswitch.co.uk/palo-alto-nat-example/        Best regards ... View more

Hello @MarkLee-ext , good afternoon   Well, you must import the certificate, if you generated it from a CSR from Palo Alto, you do not need the private key, if you generated it externally and not from a CSR from Palo Alto, you must import the certificate along with its key private.   After this, you must apply or attach to the SSL/TLS profile that you are going to use for global protect.   Best regards ... View more

Hello @OtakarKlier Good afternoon, thank you for your collaboration and your time.   Yes, but now what I was referring to was the scenario of having 2 IPSEC tunnels, with ECMP enabled (IPSEC routes equal to both tunnels: Tunnel.21 and Tunnel.22) for Site-To-Site VPN traffic. so that it is balanced, so that both links, both tunnels are used (No Dual Fail Over, I mean balanced, not that if one link fails it goes through the other, where you could use Router Monitoring or PBF). So based on the above and in a Dual Balanced scenario, not Dual Fail Over, if the Palo Alto firewall with ECMP for the tunnel interfaces, and routes of the same metric, to use both links, the Palo Alto will be sending traffic through a tunnel then through the other tunnel, so to what I mean, to have a fully balanced traffic scenario, it would require that the other peer, the other end, the other firewall, from whatever manufacturer, also have some ECMP mechanism enabled, or balancing or similar, with equal metric routes, as an example if Palo Alto sends traffic through one of its tunnels, and then through the other, if the other end does not have an ECMP type balancing or similar, for the return traffic, the other end will always forward the return traffic through its route with the best metric (thinking that it does not have something like ECMP) and therefore through its route with the tunnel with the best metric and not in a balanced way, in this scenario it could eventually occur asim traffic metric, since the PA will send traffic through both tunnels in a random and/or balanced way, but if the other end does not have something like ECMP, the return traffic will always go through its best metric and therefore always through a tunnel. Now in a full scenario balanced by both ends, both devices must have the ECMP mechanism enabled so that they can send the outgoing or return traffic through both links.   Please give your comments regarding what is mentioned in this post.   Thank you in advance for your time and collaboration.   Stay tuned to your comments   Best regards ... View more

Hello @OtakarKlier , thank you very much for your time, your collaboration and your answers.   Some doubts, regarding point or doubt number 2, if it is being given a weight, for example, prefer traffic with a greater weight, example weight tunnel.20, "200" (Best link Bandwidth and stability), tunnel.21 "50" (lower bandwidth and less stability), in that case you will always be giving more weight to one connection than the other, based on the balancing algorithms, but if you have so many problems with balancing and load balancing and routing, in that case it does not contribute much or not at all useful to use EMCP for this type of scenario (VPN IPSEC DUAL load balancing)? In that case it would be better to just use type Fail Over with PBF or with static route path monitoring?? I also understand that the other important considerations are that the other peer, the other end, with its two tunnels (regardless of the Firewall manufacturer) should also have something like ECMP or similar, since if at the routing level, the other peer, always has preference for only one of its tunnels, some asymmetric traffic could occur, or ruotung problems. Since the other end does not understand that it can reach the networks behind Palo Alto, only from one of its interfaces or only from one of the tunnels, El PAlo Alto, it will send by ECMP, through one tunnel and another, and the other end, but it does not have something like ECMP, it will forward or use the return route or the return traffic, it will always be through one of its tunnels, this referring to the peer, to the other end. Then you have to consider that in both firewalls, both in Palo Alto, and at the other end (the vendor whatever it may be), since Palo Alto could be sending traffic through a tunnel or tunnel interface of one of the IPSEC tunnels , and the other responds the same traffic and/or return route, it goes through the other tunnel, where the other firewall of the peer, from the other end, points out its preference metric to reach the networks that are behind the high pole and that knows through the ipsec tunnel, I understand that in that case we could have that type of problem, right, of symmetrical traffic? Are my considerations correct? Should asymmetric traffic be allowed in Palo Alto and at the other end?   Thank you very much for your time, for your collaboration.   I remain attentive to your comments   Best regards ... View more

Hello @JayGolf , good evening, thanks for your time:   I am using Minimum Password Complexity -Enabled, in setup/management. I am not using a password profile, but globally.   Best regards ... View more

Hello @kiwi Excellent, thanks a lot for your time!    Best regards ... View more

Hello @BPry  good afternoon, thank you very much for your time and cooperation.   OK, so that means that always, but always, even if it is in "Auto", when there are Vwire type interfaces will appear Down/RED, this expected behavior will always happen, that is Down/Red in the passive ?   Now then the recommendation is only to set Auto in Layer 3 links, that is L3 interfaces, L3 subinterfaces, Vlan interface with IP L3, but for layer two environments that is L2 interfaces or subinterfaces and Vwire deployment, the recommendation is not to use auto to avoid any network loop.   But example in interfaces or subinterfaces of L2, these if they appear in Up and green, when it is in Auto, but nevertheless the recommendation is not to use auto in these cases ?   Thank you for your support and I would appreciate if you could please rectify the above mentioned points.   I remain attentive to your comments.   Best regards ... View more