About darren_g

darren_g · ‎05-27-2019

Hi folks. I need to configure a L3 iterface with a trunked conenction to my core switching infrastructure - twos eperate VLAN's on the one physical interface which MUST be seprate VLAN's, security zones and IP ranges. I can't figure out if I'm mking this work right - I add sub interfaces tot he physical interface configuration, and they are tagged - but the main interface isn't. Do I need to create VLAN's to match the sub-interface definitions? VLAN INterfaces? Or does the act of creating the sub interface get it working? I'm quite confused over this one. Thanks.

darren_g · ‎05-14-2019

@BPry wrote: @darren_g, You don't tell it which tunnel to fail over to, it simply disables the tunnel interface. Disabling the tunnel interface will take your first route out of consideration as far as the firewall is concerned (because it can't use a disabled interface) and the second route you have configured will take over as it's the remaining route. Another option of doing essentialy the same thing is configuring Path Monitoring on the route entry itself, which would be independent of the Tunnel Monitoring. You can view that method of operation HERE Essentially either option would work fine here, but the Tunnel Monitoring helps you by attempting to re-negotiate the IPSec keys between peers instead of simply removing the static route. Ahh, OK, so I just enter two static routes to the different tunnels, and if the primary fails, it disables and the other route automatically takes over. That's a lot clearer now. Thanks! So when you apply the tunnel monitor, the "destination IP" is any address on the other end of the link? Or is it specifically the tunnel interface address at the other end? I'll look into path monitoring too - thanks!

darren_g · ‎05-14-2019

@BPry That's good, but how do you tell it which tunnel to fail over to? I can't see where to configure it to pick a specific tunnel to fail the traffic over to. Do you simply set two static routes pointing to both tunnels, or is there some other magic that needs to be worked to make this selection choice? Thanks

darren_g · ‎05-14-2019

@BPry wrote: @darren_g, Do you have a tunnel monitoring profile assigned to the tunnel at all? @BPryNo, I don't, because I don't really understand the purpose and functionality of them - they seem pretty simple to configure, but how do you apply them - and more importantly, how do you tell them which tunnel to fail over to?

darren_g · ‎05-14-2019

Hi folks/. I have a situaiton that is doing my head in, and I need some help. I have an installation which looks like this "A" end - Palo Alto Active/Passive cluster, public IP for IPSec VPN termination "B" End - Juniper SRX cluster, Active/Active with TWO IP addresses (separate links) for IPSec VPN initiation I have configured two tunnels from the SRX to the Palo Alto - different tunnel interfaces, different IPsec tunnel and IKe configurations - and they come up just fine (after some fine tuning). Where I'm running into trouble is getting routing to work. I've added a static route for the remote subnet into the virtual router pointing to the main tunnel, and a second one pointing to the secondary tunnel with a higher metric (administratifve distance), but for some reason if the primary tunnel drops (there are issues with re-keying I'm working on with the Juniper side), the routing does not switch to the secondary. Can I configure the routing on the Palo Alto so that it checks for the other end - even if the tunnel is up - and fails to the second route if it gets no reply across the primary tunnel? I am scratching my head here - for the life of me, I can't make these things match up on both ends - so I'm looking for help on the Palo Alto end here to see what I can do to try and improve things. Thanks for anything you guys can point to.

darren_g · ‎05-24-2018

@BPry wrote: @darren_g, If you export the XML configuration you'll see the actual CSR in the running-config.xml. You, Sir, are an absolute legend! That did the trick. Thanks!

darren_g · ‎05-24-2018

@rrau wrote: 3000 series FW, software 6.0.1, GP 2.0.1 -- GP continually disconnects/reconnects.. tried reinstalling client, rebooting, etc.. happens with some users at random times..then the issue will magically go away. Anyone else experience? I've seen this caused by some kinds of cable or DSL modems on the remote end. It's got soemthing to do with the way some modems do UDP security - they allow the connection/authentication, but block the packets after the connection competes, resulting in a timeout and disconnect. Once it disconnects, the client goes back to phase 1 and reconnects and discovers fine - but then times out again after 5 minutes. The various modem/router manufaturers call the settings different things - ALG, PnP Security, some toher things. It's particularly common on DLink routers I'm not sure if I can link to external dicsussions here - I'll try Example 1, Example 2, Example 3

darren_g · ‎05-24-2018

Folks. I'm trying to generate a CSR for a new security certificate for one of my firewalls. I can generate the CSR just fine. it shows int he certificate list as "pending". Which is what I expect. What I can't do it export the CSR. I select it, click "export" from the action options, and the screen just blanks for a few seconds and goes back to where I started. This happens if the config holding the pending certificate is committed or not. Has anyone seen this and know how the heck I can get the CSR out of the box to give to the CA for certificate generation? Box is a 3020 running 7.1.17 Thanks to anyone who can help

darren_g · ‎02-05-2018

hi Otakar. I won't allow content upgrades to install automatically - I've been bitten in the backside one time too many by bad upgrades breaking things for this - I manually install them all when I'm around, so I can roll back quick if I start getting complaints. Virus definitions are different - they can install automatically - but content and app definitions I don't trust. Still don't know why I'm seeing so many of them on PanOS 8, though. My other firewalls are on 7, and they still only see the three releases.

darren_g · ‎02-04-2018

Hey folks. I don't know if this is intentional or not, but it's annoying as hell, and if it's configurable, I'd like to know hwo to fix it. Since upgrading to Pan OS 8 on one of my PA's (a 500), I've noticed that when I check for dynamic updates, I get multiple versions dispplayed - like the below Previous versions only displayed three - the current, the previous (for rollback), and the new (waiting for download/install) Does abnyone know if there's a way to return to this previous behaviour? Or do I just need to suck it up and check dates super carefully to make sure I have the latest version? Thanks

darren_g · ‎12-20-2017

@mgarg wrote: Some from the engineering team should be able to comment on whether all virtual interfaces get same mac address as per design. As far as configuration is concerned, I don't believe there is a setting which allows you to force unique mac addresses or assign them statically. That was what I was afraid of. Thanks anyway.

darren_g · ‎12-20-2017

Folks. I have a requirement for setting up an EC2 Windows server in a remote Amazon region for receiving files. On this server, I need some custom API stuff (easy) to allow file transfer from the Internet - but I also need a secure VPN to my normal site elsewhere to I can connect to several databases and other services which are *not* available on the Internet. Does anyone know if it's possibel to use the Amazon VPN to setup an IPSec to my Palo Alto's (PA 3050, currently running 6.1.19) to allow for connections to the internal servers? Or would it be easier to leave a console user logged on and run Global protect? While that might work, it's an ineligant solution as it needs all the remote processes to run as that user to be able to access the resources? Thanks for any input

darren_g · ‎10-25-2017

HI. We run global protect for a reasonable number of remote users on our PA3050's without much in the way of issues. One thing which pops up, though, is that our Virus management server (McAfee) gets hugely confused about which machines are on which IP address. We've done a little digging, and it apepars to be related to te fact that all machines conencting via global protect appear to get the same virtual MAC address for the tunnel interface - and this reports to the virus server. Which means, of course, every time someone establishes a new VPN connection the virus server gets a new hostname assigned to the MAC address - which is normally wrong. Does anyone know if there is any way I can force each new connection on GP to get a unique virtual MAC on the tunnel interface on the local PC? If so, how? I've had a poke around and I can't seem to find any way to do it. Thanks

darren_g · ‎07-26-2017

@TranceforLife wrote: I would strongly advise you to get the devices upgraded as you are on EOL release: https://www.paloaltonetworks.com/services/support/end-of-life-announcements/end-of-life-summary I did an upgrade to 6.1 today. And my fears were correct - it broke things. Luckily, they were easy to fix things, but now I know why I was holding off on upgrading. Oh well. I'll wait a while until I go to V7, methinks.

darren_g · ‎07-25-2017

Thanks - I'll continue to ignore it for now. It doesn't appear to be breaking anything anwyay. Yes, the upgrade process is fairly easy and can actually be done without any downtime. However, be very careful of the behavior changes. It's a big leap from 6.0 to 7.1. Check through all the tech-docs about behavior changes, what's new, new features, upgrade/downgrade considerations, etc. That's the main reason I haven't upgraded yet - I have other PAN devices running later versions, but this is my main production cluster, and has many, many more policies and features enabled - and I don't have time to validate the upgrade and check if anything will break. I might bump it to 6.1 in the near future and let that run a while before going to 7. Thanks again.

Member Since	‎09-16-2012 09:05 PM
Date Last Visited	‎09-24-2024 07:23 PM
Posts	285
Total Likes Received	57

Online Status	Offline
Date Last Visited	‎09-24-2024 07:23 PM

About darren_g

Network monitor shows huge traffic spike, but can't find traffic details

Re: LogDB Import failing - anyone suggest why?

Re: Split tunnel specific URL only, not entire site?

Split tunnel specific URL only, not entire site?

Re: Implications of "No direct Access to Local Network" toggle in Global protect client settings?

Re: Implications of "No direct Access to Local Network" toggle in Global protect client settings?

Implications of "No direct Access to Local Network" toggle in Global protect client settings?

Global protect DNS and Windows 10 Home

Re: Global Protect Split Tunnelling on Domains - client version issue?

Re: Can Panorama managed devices be configured via the CLI?

Re: Force HA failover - how?

Re: LogDB Import failing - anyone suggest why?

Re: Scheduled reports not working

Re: BGP sessions not exporting

Restricting VPN access to internal services on per-user basis

Re: IPSEC vsys cli

Re: HOWTO Wanted : Trunked L3 intrerface with tagged VLAN's

Re: HOWTO Wanted : Trunked L3 intrerface with tagged VLAN's

Re: IPSec VPN routing across multiple tunnels

Re: IPSec VPN routing across multiple tunnels

HOWTO Wanted : Trunked L3 intrerface with tagged VLAN's

Re: IPSec VPN routing across multiple tunnels

Re: IPSec VPN routing across multiple tunnels

Re: IPSec VPN routing across multiple tunnels

IPSec VPN routing across multiple tunnels

Re: Certificate creation - unable to export CSR

Re: Global Protect disconnect issue

Certificate creation - unable to export CSR

Re: PAN OS 8 displaying multipe threat/anti virus versions

PAN OS 8 displaying multipe threat/anti virus versions

Re: Global protect and virtual MAC address

IPSec VPN from EC2 server to remote Palo Alto possible?

Global protect and virtual MAC address

Re: Strange system error messages

Re: Strange system error messages

Unlock your full community experience!

About darren_g