About abjain

  Hi,   You can use the following command:    > debug system interface-xcvr-info aux-1           Identifier          : 0x03 (SFP)         Extended identifier : 0x04 (GBIC/SFP defined by 2-wire interface ID)         Connector           : 0x07 (LC)         Transceiver codes   : 0x00 0x00 0x000x01 0x00 0x00 0x00 0x00                             :  => Ethernet: 1000BASE-SX         Encoding            : 0x01 (8B/10B)         BR, Nominal         : 1300MBd         Rate identifier     : 0x00 (unspecified)         Length (SMF,km)     : 0km         Length (SMF)        : 0m         Length (50um)       : 550m         Length (62.5um)     : 270m         Length (Copper)     : 0m         Length (OM3)        : 0m         Laser wavelength    : 850nm         Vendor name         : OEM                      Vendor OUI          : 00:00:00         Vendor PN           : PAN-SFP-SX               Vendor rev          : 2.0   > show system state | match aux-1   cfg.aux_intf.map: { 'aux-1': eth5, 'aux-2': eth6, } cfg.ha.net.s0.out-of-band: { 'additional-ha1': [ ha1-b, aux-1, aux-2, ], 'aux-1': eth5, 'aux-2': eth6, 'default-ha1': ha1-a, 'default-ha2': hsci, 'default-ha3': hsci, 'ha1-a': eth1, 'ha1-b': eth2, 'hsci': sys.s1.ha1., 'management': eth0, 'mirror': [ ha1-a, ha1-b, hsci, ], } cfg.net.s0.eth5.cfg: { 'disable-dhcp': True, 'fips-gated': True, 'ip-type': static, 'ipaddr': , 'ipv6addr': , 'mtu': 1500, 'netmask': , 'onboot': True, 'routes': { 'default': , }, 'table': aux-1, 'up': True, 'v6routes': { 'default': , }, } net.s0.eth5.cfg: { 'disable-dhcp': True, 'fips-gated': True, 'hwaddr': d4:f4:be:c3:9f:e2, 'ifindex': 7, 'ip-type': static, 'ipv6linklocal': fe80::d6f4:beff:fec3:9fe2/64, 'mtu': 1500, 'onboot': True, 'routes': { 'default': , }, 'running': True, 'table': aux-1, 'up': True, 'v6routes': { 'default': , }, }           > show system state | match eth5   cfg.aux_intf.map: { 'aux-1': eth5, 'aux-2': eth6, } cfg.ha.net.s0.out-of-band: { 'additional-ha1': [ ha1-b, aux-1, aux-2, ], 'aux-1': eth5, 'aux-2': eth6, 'default-ha1': ha1-a, 'default-ha2': hsci, 'default-ha3': hsci, 'ha1-a': eth1, 'ha1-b': eth2, 'hsci': sys.s1.ha1., 'management': eth0, 'mirror': [ ha1-a, ha1-b, hsci, ], } cfg.net.s0.eth5.acl: { 'peers': [ ], 'services': [ ssh, https, icmp, ping, icmp, ], 'v6peers': [ ], } cfg.net.s0.eth5.acl-extra.ha: { 'direct': { }, 'services': [ ], } cfg.net.s0.eth5.cfg: { 'disable-dhcp': True, 'fips-gated': True, 'ip-type': static, 'ipaddr': , 'ipv6addr': , 'mtu': 1500, 'netmask': , 'onboot': True, 'routes': { 'default': , }, 'table': aux-1, 'up': True, 'v6routes': { 'default': , }, } cfg.net.s0.eth5.hwcfg: { 'mode': 1, 'setting': 1, } net.s0.eth5.cfg: { 'disable-dhcp': True, 'fips-gated': True, 'hwaddr': d4:f4:be:c3:9f:e2, 'ifindex': 7, 'ip-type': static, 'ipv6linklocal': fe80::d6f4:beff:fec3:9fe2/64, 'mtu': 1500, 'onboot': True, 'routes': { 'default': , }, 'running': True, 'table': aux-1, 'up': True, 'v6routes': { 'default': , }, } net.s0.eth5.hwcfg: { 'advertised': [ 1Gb/s-full, auto, ], 'link': Up, 'mode': Autoneg, 'setting': 1Gb/s-full, } net.s0.eth5.stats: { 'rx-bytes': 0, 'rx-compressed': 0, 'rx-drop': 0, 'rx-errs': 0, 'rx-fifo': 0, 'rx-frame': 0, 'rx-multicast': 0, 'rx-packets': 0, 'tx-bytes': 0, 'tx-carrier': 0, 'tx-colls': 0, 'tx-compressed': 0, 'tx-drop': 0, 'tx-errs': 0, 'tx-fifo': 0, 'tx-packets': 0, }     Regards   ... View more

Hi,   I guess having NATs in Shared gateway will be more appropriate. If you configure NAT on vsys, there will be routing considerations on the Shared gateway vsys.   Here is an article for a bidirectional NAT involving shared gateway: https://live.paloaltonetworks.com/t5/Configuration-Articles/Configuring-Destination-NAT-using-a-VSYS-with-Shared-Gateway/ta-p/55187   Please see if it helps. You can approach TAC if need any specific help.   Best Regards, Abhishek ... View more

Hi,   Did you had a chance to look at https://live.paloaltonetworks.com/t5/Management-Articles/DNS-Suffix-is-not-Listed-under-GlobalProtect-Network-Adapter/ta-p/58001   If this is already verified, could you check if the issue is specific to any Client OS/ GP version?   BR ... View more

As I understand syslog facility is used on the syslog server to decide which log goes into which file. Facility will not help to increase or decrease the level of logging on the firewall.   As per RFC: https://tools.ietf.org/html/rfc3164 following are the facility codes defined:     Facility code Keyword Description 0 kern kernel messages 1 user user-level messages 2 mail mail system 3 daemon system daemons 4 auth security/authorization messages 5 syslog messages generated internally by syslogd 6 lpr line printer subsystem 7 news network news subsystem 8 uucp UUCP subsystem 9   clock daemon 10 authpriv security/authorization messages 11 ftp FTP daemon 12 - NTP subsystem 13 - log audit 14 - log alert 15 cron scheduling daemon 16 local0 local use 0 (local0) 17 local1 local use 1 (local1) 18 local2 local use 2 (local2) 19 local3 local use 3 (local3) 20 local4 local use 4 (local4) 21 local5 local use 5 (local5) 22 local6 local use 6 (local6) 23 local7 local use 7 (local7)   Whereas the severity under the Log forwarding profile helps to decide what kind of logs you want to send to the syslog server.   You can choose to send different severity logs to the same syslog server with different facility values, so that they can be handled separately by the server. I hope this helps.   -BR ... View more

I agree with the suggestions made. There is no way to keep the PBF rules for primary ISP disabled for some time. There has to be some manual intervention or external intervention.   But there should not be any issues with the existing sessions I believe if "wait-recover" is used in the monitoring profile. Is there a problem if new sessions start using primary ISP? ... View more

Please read this document for understanding how Dos protection works: https://live.paloaltonetworks.com/t5/Documentation-Articles/Understanding-DoS-Protection/ta-p/54562   You need to look at aggregate profiles and classified profiles for understanding how will firewall classify dos attack in case of DDOS. ... View more

Could you share more details of your requirement along with some topology? That way we can make more suggestions ... View more

I think you are past the query obout priority, but I dont see how priority will affect anything here. Priority on OSPF interfaces is to influence the DR/ BDR election. In this case I think metric should be used to influence which path should be used.   I am assuming you have a topology like this.   PAN ------ PE ---- MPLS (BGP) ---- PE------ Remote Site   \ -------------- OSPF over IPSEC --------------/   In this case you can ask PE to run BGP with PAN firewalls and then you can use administrative distance for BGP learned routes to be preferred over OSPF learned routes over the tunnel. Also from the PAN firewalls you will have to redistribute the local routes to BGP peers.   Or if you are interested in running OSPF on PAN, then you can do the same, provided the PE router and the PAN share a common network. In this case, you cannot let the OSPF over IPSEC and OSPF to PE run in same virtual router as it will cause the OSPF to advertise your link to PE over IPSEC, which will cause tunnel to flap.   You will need to have to use another virtual router for the OSPF to PE. You can still use the same area as the one for IPSEC ospf. ... View more

Hi,   For the use of special caharacters in GP, there was a bug reported which is fixed in 7.0.2 onwards. This seems to be an issue in 7.0.1 only.   https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os-release-notes/pan-os-7-0-2-addressed-issues.html   -> Bug 82675   For case senstitive usernames, please report this to support team.     BR ... View more

Could you verify the licenses are proper and installed and updated in the support portal?   Also please enable debug mode on management server and collect the logs:   > debug management-server on debug > tail follow yes mp-log ms.log   Now do a Check Now from GUI or "request content upgrade check" from another CLI to see what are the logs showing.   At the end set the management-server debug to info level:   > debug management-server on info    If licenses are properly installed, and logs do not show enough information, kindly open a support case ... View more

Hi,   In your case, when ISP connected to PA is down, is all the forward traffic (Client-> Internet) still going through the Palo Alto?   Two things are possible:   1. When Palo Alto forwards traffic back to Cisco, it sends a ICMP redirect to the L3 switch. I don't think PA does that. 2. Palo Alto sends traffic to Cisco, which forwards it out to Internet, but the reply traffic is forwarded directly by Cisco to L3 switch.    In case 2 above, Palo Alto will only be seeing half of the traffic and this is a scenario of asymmetric routing. Palo Alto session will not see a SYN/ACK so the session does not matures and times out after 5 seconds (Default TCP init timeout).   You can do two things,   1. Allow asymmetric bypass on the PA firewall and disable TCP Reject Non SYN:   # set deviceconfig setting tcp asymmetric-path bypass # set deviceconfig setting session tcp-reject-non-syn no # commit   2. Do a hair pinning NAT, so that when PA firewall forwards the traffic to Cisco, it does a source NAT on this traffic, so that the Cisco will see traffic coming from PA, and hence will forward reply packets to PA. For this create a source NAT rule from trust to trust zones doing a source NAT on e1/1 IP.   Regards ... View more

You can create multiple PBF rules with different monitored IPs.   Note: This PBF rules will NOT provide redundancy for existing sessions. For any existing sessions using PBF rule 1, if the PBF Rule 1 fails, the traffic will failback to routing table. It will not use the PBF rule 2. Only for new sessions the traffic will start using PBF Rule 2. ... View more