About Sanjay_Ramaiah

Hi Team, We have a requirement to configure the Global Protect as below. > We have 3 locations to connect to.  Users should connect to one of these 3 locations based on their nearby location. If User 1 is near to GW3 then he should connect to GW3. If GW3 is not available, then the next nearest location should be connected automatically. Is this possible?  If so what is the best way to acheive this? Regards, Sanjay S ... View more

Hi All, When it comes to Static NAT it will be one to one NAT in vendors like Checkpoint and Cisco ASA. I am bit confused with the NAT configuration in Palo Alto. Went through config guide and examples of NAT as well but still confused. We have a scenario as below. We have 3 zones - WAN, LAN and DMZ. Users want to reach DMZ interface from WAN and vice versa. IP: 10.10.10.10 shd be translated to 1.1.1.2 WAN Int: 1.1.1.1/29 So ACL is configured as below: WAN to DMZ Zones port 443 is allowed. Src Int: WAN Src: Any Dst Int: DMZ Dst: 1.1.1.2 Port: 443   Src Int: DMZ Src: 10.10.10.10 Dst Int: WAN Dst: Any Port: 443   NAT: Src Zone: DMZ Dst Zone: WAN Dst Int: WAN Src Add: 10.10.10.10 Dst Add:Any Src Trans: Static IP(1.1.1.2)Bi-directional Dst Trans:none   Src Zone:WAN Dst Zone: DMZ Dst Int:DMZ Src Add:Any Dst Add:1.1.1.2 Src Trans:none Dst Trans:dst-translation(10.10.10.10)   Is there anything wrong with this?   Though 1.1.1.2 is directly connected to WAN. Traffic from outside to 1.1.1.2 to is going to LAN interface instead of DMZ. I am concerned with my NAT understanding in Palo.   Any suggestions on this would really help.    Regards, Sanjay S     ... View more

Hi All, Please help. I never configured Sub-Interface in PA. There is a new requirement to configure a sub-interface under already configured interface. So my doubt is how this Sub-interface if we already configured the physical interface with the IP address? What is the use of Sub-interface is it similar to the VLAN interfaces in Checkpoint and ASA? In what situations we use Sub-interfaces? What is the use of VLAN if sub interfaces act as VLAN interfaces? Also can we configure 2 interfaces with the IP addresses in the same subnet? Like 1.1.1.1/29 on one interface and 1.1.1.2/29 on other interface and attach different VRs to both those interfaces? Regards, Sanjay S ... View more

Hi All, We need to implement Split-Tunneling for M365 only for the Mobile Users in Prisma. Please suggest us the best way to Implement? Can we implement using EDL? Or we have to add all the FQDNs one by and then acheive it? Regards, Sanjay S ... View more