About Sujanya

Sujanya · ‎04-20-2023

Hi @OtakarKlier , Thanks for responding. We are not able to ping the customer gateway and as well as network as ping is not allowed from them. Will the keepalive still works in that situation.

Sujanya · ‎04-20-2023

We have created an tunnel with SAP and as per their suggestion we have disabled tunnel monitoring, keepalive settings from our end. It is IKEV2 tunnel. We noticed that after sometime due to traffic not flowing suddenly Phase-2 is going down, as soon as it goes down we were seeing the issue in connectivity. As soon as manually trigger the tunnel and if the tunnel comes up, connectivity works again. Any suggestion here.

Sujanya · ‎04-17-2023

Hi All, Consider there is an user (xyz@example.com) is accessing some network for which communication is allowed in firewall based on USER-ID rules. If the User(xyz@example.com) at the same times access the allowed sites by using two different IP address, will the communication from both the machines would be allowed.

Sujanya · ‎04-17-2023

Hi @kiwi , Thanks for the response. I have raised TAC case and given the required logs. I will keep updated with the progress.

Sujanya · ‎03-28-2023

We are using WinRM-HTTPS protocol in the Agentless User-ID configuration, when connecting to the Domain Controller(s) firewall is using the default port as 88. Palo-Alto firewall version is 10.2.3-h4 . Server-Monitoring shows Authentication-failed or Connection refused error for all the Domain Controllers, but in 10.2.6.-h6 version we can at least see few of the domain controllers showing connected. Kindly help us with the suggestion on the above.

Sujanya · ‎03-24-2023

We have over 80+ firewalls in our environment, all of them of version 10.1.6.-h6 , we are using Kerberos profile in the user-id agent set-up and every server monitor status seems connected. Except for the firewall which is with PAN-OS version 10.2.3.-h4, even after using the same parameters. getting below error: Server monitor HOSTNAMEDP(vsys1): connection failed, HTTP code 401, (null) Kindly suggest us on above condition.

Sujanya · ‎03-24-2023

Hi @PavelK , I upgraded the Palo-Alto to 10.2.3 version, and now Kerberos profile issue has been resolved. But I still I can see server monitoring status is not showing as connected.

Sujanya · ‎03-03-2023

I am seeing the Ip address give to the tunnel interface is wrong ( for the tunnel with AWS) , but tunnel came up and working without any issue. Can anybody suggest on this. Would the IP address which we will give to the tunnel interface would not matters.

Sujanya · ‎02-21-2023

Hi All, If we set mtu value as 9192 in interface and 9072 as sub-interface, which one the sub interface choose. If it will choose 9072, would that mean 9072 size packet can be sent. Similarly, If we set mtu value as 9192 in interface and kept the sub interface blank, what mtu will be choosen.

Sujanya · ‎02-20-2023

Hi @aleksandar.astardzhiev , I have done the change as per your suggestion. It worked fine. Thank you so much for your help.

Sujanya · ‎02-19-2023

Hi All, If we set mtu value as 9192 in interface and 9072 as sub-interface, which one the sub interface choose.If it will choose 9072, would that mean 9072 size packet can be sent. Similary, Hi All, If we set mtu value as 9192 in interface and kept the su interface blank, what mtu will be choosen.

Sujanya · ‎02-06-2023

Hi All, How to keep the tunnel idle time out as zero, so that our VPN tunnel will not go down even if no traffic.

Sujanya · ‎02-01-2023

Hi @Raido_Rattameister , Thanks for the filter. Yes I can see 'ping' and 'snmp' related traffics.

Sujanya · ‎01-31-2023

Hi @Adrian_Jensen , I can see the encapsulation count as zero, but the decapsulation count is increasing continuously. VPN monitor is disabled at both the end. There is no interesting traffic observed in the monitoring traffic logs.

Sujanya · ‎01-26-2023

Hi All, Our vendors are migrating their IPSEC tunnel firewall, which is resulting to change the tunnel gateway IP from our palo-alto firewall end as well. So, we are thinking just to create one more ipsec tunnel without tagging the tunnel interface and during maintainace window just to bind the tunnel interface to our new Ipsec tunnel and unbind the same from old ipsec tunnel. Will the above thinking will work ?

Member Since	‎04-13-2022 12:20 AM
Date Last Visited	‎04-07-2024 01:29 PM
Posts	73
Total Likes Received	6

Online Status	Offline
Date Last Visited	‎04-07-2024 01:29 PM

About Sujanya

Re: Right way of moving cable

Right way of moving cable

Export details of Global Protect Client users running below version less than < 5.2.12

Re: upgrade Global Protect Client

upgrade Global Protect Client

Pa 410 model pan os download issue

Re: Interface Monitoring

Re: Interface Monitoring

Interface Monitoring

Re: IPSEC tunnel Phase-2

Right way of moving cable

Re: Server-Monitoring shows Authentication-failed or Connection refused error

Server-Monitoring shows Authentication-failed or Connection refused error

Re: Post fixing the firewall from maintenance mode , facing issue in log forwarding

Re: Suggestion on Initial Configuration of Palo-Alto

Re: Right way of moving cable

Re: upgrade Global Protect Client

Re: Interface Monitoring

Re: IPSEC tunnel

Re: SA of the tunnel is Active

Nominated Discussion: Wrong IP Address But Tunnel is Up

Re: IPSEC tunnel Phase-2

IPSEC tunnel Phase-2

USER-ID mapping by firewall

Re: Server-Monitoring shows Authentication-failed or Connection refused error

Server-Monitoring shows Authentication-failed or Connection refused error

Server Monitoring of User-ID agent set-up shows Authentication failed /Connection refused error

Re: Palo-Alto network user-ID agent set-up

Given Tunnel Interface IP is wrong but still tunnel is up

MTU size clarification at Interface and Sub-Interface level

Re: IPSEC tunnel

MTU value

Re: IPSec VPN Idle Timeout

Re: SA of the tunnel is Active

Re: SA of the tunnel is Active

IPSEC tunnel

Unlock your full community experience!

About Sujanya