About networkadmin

networkadmin · ‎08-12-2010

We want to use our PA-500 (3.1.3) at our site to create a tunnel to a remote site which will have a McAfee/Secure Computing Sidewinder. I've never used IPSEC VPN before so I guess I want to be clear on how I do this. Our PA-500 is setup in a simple L3 deployment, so: ethernet1/1 is "trust" private IP of 10.6.1.1/16 ethernet1/2 is "untrust" public IP of 193.35.x.x/24 and a single virtual router. The remote sites LAN IP range will be 10.7.x.x/16 and for their public IP for testing will also be 193.35.x.x/24 as I'll be connecting the Sidewinder to the same switch/subnet as the PA-500's ethernet1/2 interface. So at our main site everyone's default gateway is our main router, which routes 0.0.0.0 to 10.6.1.1. What we want is for all traffic in the remote site to be tunnelled back here, and to go out through out PA-500 so their traffic is subject to the same policies as ours. I appreciate the Sidewinder is outside the scope here so I'll have to work that out, but with regards to the PA-500 any pointers on a quick and simple config to achieve what I want? Thanks in advance.

networkadmin · ‎08-09-2010

As subject really. Let's say I want to be notified via logging if certain words are found in Office document attached to emails, is this something I can do with data filtering on the PAN? Just looking at the options.

networkadmin · ‎07-23-2010

Thanks, it's logged with Vadition. I'll see what they suggest as I'm open to doing a remote session but with the time difference it depends how everyone's fixed Monday. I presume there's no sort of automated internal "polling" that will say "Oh that's died" and restart the service or anything, it's dead until I prod it? Cheers.

networkadmin · ‎07-23-2010

Always seems to happen out of hours but... the management NIC on our PA-500 seems to have dropped off the face of the earth. I can't ping it, I can't SSH/Telnet to it, nor can I get to the web GUI. Fortunately the PAN does still appear to be passing traffic, but assuming there's no dead daemon/service that will automatically restart at some point, if I walk in Monday and have to pull the power cord, is there anything I can look at that might help me or support work out what has happened? It's running 3.1.3. Thanks.

networkadmin · ‎07-19-2010

Are we any nearer to being able to do this please?

networkadmin · ‎07-17-2010

I have a PA-500 at our main office. We have a smaller site that currently we have a point to point circuit to, however we may not renew the contract on this, and instead put in a cheaper but faster internet leased line, the idea being to link the two sites through a VPN tunnel. The other site is too small to justify another PA-500, and I think "Plan A" would be to tunnel all traffic back through the main site. My question is how simple IPSEC VPN is to configure with a non Palo Alto box at one end, and if it makes any difference what box is at the other end so long as it supports IPSEC VPN - is there anything that the Palo Alto doesn't get on with? Thanks.

networkadmin · ‎06-17-2010

Cool thanks. Sounds like maybe in 3.1.4 then (I'm assuming 3.1.3 is finalised and awaiting release).

networkadmin · ‎06-16-2010

Hi, Is there any update on if/when this feature will be available please? Thanks.

networkadmin · ‎06-09-2010

Stephen can you confirm exactly what categories of site "Internet Communications" contains please? Is it just Instant Messaging or would it include things such as Skype and other VOIP sites or webmail or anything like that? Thanks.

networkadmin · ‎06-09-2010

As far as I'm concerned the override page doesn't have to be SSL at all, that was the default and I didn't spot an option for it to not be SSL - if that's possible I'm interested to know how?

networkadmin · ‎06-07-2010

Thanks. Any ideas why the same URL works on some PCs and not others though (one chaps PC he gets blocked using IE, doesn't using Firefox).

networkadmin · ‎06-07-2010

Running 3.1.2 and have quite a few instances in our PAN log where for some reason a URL (not noticed a pattern other than the URL preceding the problem URL is typically really damned long and some sort of query/search) is blocked and all that shows on the block page or in the PAN logs is ".com/" or ".net/", the category is typically spam-urls. What's really weird is that the policy is applicable to all staff/machines yet on some machines this happens, on others it simply doesn't happen. Any ideas please? It's logged with Vadition but any thoughts appreciated.

networkadmin · ‎06-03-2010

Did a remote session with our vendor and Palo direct - seems the daemon (for lack of a better word) that handles all that stuff has died, but due to the time difference no devs were in the offices at PAN to take a look at the logs. He gave me a command sequence to run to restart the service, not at the office right now to recall what it is, but if someone from PAN is reading this I'm sure they'll have some input.

networkadmin · ‎06-03-2010

Yesterday our PAN started running very slowly i.e. lots of sites taking forever to start loading. I noticed on Dynamic Updates, for URL filtering I have this error listed: Error: Failed to get response from device server. Please try again later. If I disable URL filtering on my policies everything is working perfectly. Nothing has changed on the PAN and web/threat/virus updates are occurring sucessfully i.e. outbound connectivity is there. Any ideas please? It's running 3.1.2

networkadmin · ‎06-01-2010

So you're saying if I have a URL filtering profile "Corp Default" that had www.domain.com in its allow list section, and I then remove www.domain.com from the allow list and add it to a custom URL category, I can't delete that custom URL category without deleting the entire original "Corp Default" URL profile, which is used on all manner of access rules...? Have I misunderstood, because if that's correct surely that can't be by design as it just seems plain broken? I presume I could clone "Corp Default" to at least save a little of the duplication work needed here?

Member Since	‎02-12-2010 10:34 AM
Date Last Visited	‎09-16-2017 04:35 PM
Posts	242
Total Likes Received	16

Online Status	Offline
Date Last Visited	‎09-16-2017 04:35 PM

About networkadmin

Re: Content Versions 706 & 707 - some explanation needed

Re: Forcing TLS/SSL decryption to cipher suite PAN can decrypt?

Forcing TLS/SSL decryption to cipher suite PAN can decrypt?

Re: MineMeld real-world usage to reduce threats?

MineMeld real-world usage to reduce threats?

Skype for Business using App-ID?

Re: Rule too allow access to group of URLs?

Re: Rule too allow access to group of URLs?

Re: Rule too allow access to group of URLs?

Rule too allow access to group of URLs?

Re: Import PA-500 config on PA-3020?

Re: Exclude URL

Re: How do I check how a URL is categorized and suggest changes or corrections?

Re: CVE-2015-0235 Ghost

Re: Paloalto to Firebox

Re: Forcing TLS/SSL decryption to cipher suite PAN can decrypt?

Re: vwire using a single physical interface possible?

Re: Dynamic Block List - Limit on number of entries?

Re: CVE-2015-0235 Ghost

Re: CVE-2015-0235 Ghost

Setting up an IPSEC VPN?

Data Filtering - Finding words in SMTP attachments?

Re: PA-500 Management NIC Dead?

PA-500 Management NIC Dead?

Re: Error deleting custom URL categories?

IPSEC VPN Help?

Re: Error deleting custom URL categories?

Re: Error deleting custom URL categories?

Re: Best method to block Instant Messaging

Re: URL Filtering Override SSL Certificate

Re: .com and .net sometimes blocked as spam?

.com and .net sometimes blocked as spam?

Re: URL Filtering - Error: Failed to get response from device server. Please try again later.

URL Filtering - Error: Failed to get response from device server. Please try again later.

Re: Error deleting custom URL categories?

Unlock your full community experience!

About networkadmin