About 9t89m8fu

  Look into BGP export filters   ... View more

This is mandated by RFC 4303 ... View more

  That article is outdated. Current versions of PANOS support Graceful Restart for OSPF.     ... View more

10Mbit/s is a far cry from 50. What's more likely to be your problem is that performance is getting degraded due to fragmentation. Try dropping the MTU on your tunnel interfaces to about 1400 and make sure MSS is getting clamped. Also check your algorithms. You should be using AES instead of 3DES, try GCM instead of CBC, etc. ... View more

  Slightly off-topic, but Palo Altos can in fact terminate non-encrypted IPSec. Both AH and null-encryption ESP are supported in PAN-OS 8.0.     ... View more

@MarioMarquez wrote:   I am assuming that if traffic hits a virtual router & there are multiple routes to the same destination address the Palo Alto will first prefer the route with the most specific destination prefix (longest prefix match) and if the prefix's are the same for all routes the Palo Alto will prefer the route with the lowest Administrative Distance & if the Admin Distance is the same for the for all routes the Palo Alto will prefer the route with the lowest Metric.  Is this theory correct?   Correct   ... View more

Cisco TAC recommended adding an mtu ignore command on the core routers which brought everything online. This was bad advice. Tricking the devices into thinking their MTUs match can result in a DBD packet being sent that is too large for the recipient to process, leaving you stuck in exstart, as you have seen. You need to fix the MTU mismatch, not hide it.   ... View more

First off, ECMP does not require a dynamic routing protocol. You can do ECMP with static routes if you want (not that I'm recommending this, but it's an option).   Second, there is absolutely no reason you couldn't run an IGP between your firewall cluster and L3 switches. This is perfectly fine, and common in larger networks. If your switches are not stacked, this is your best option (if anything, I would personally avoid stacking core switches).   Third, depending on your firewall model, ECMP may not get you any benefit. If your firewall can only process 1Gb/s for example, there's little benefit in having two ECMP 1Gb/s downlinks. All you really care about in that scenario is redundancy.   ... View more

What have you tried so far? ... View more

Prepending only affects BGP decisions; you can't make a neighbour prefer an OSPF route over a BGP route by prepending. ... View more

Yes. ... View more