About jperry1

PAYG type licensing is not associated directly with Palo Alto Networks. That being saidyou will be charged hourly or annually depending on the type of license you use. But PAYG is listed as a consumption based licensing model so if your VM is powered off then there is no consumption. See the link below for information on PAYG and BYOL licensing.    https://live.paloaltonetworks.com/t5/AWS-Azure-Articles/VM-Series-for-AWS-and-Azure-Licensing-Considerations/ta-p/125552 ... View more

If you see the routable Public IP addresses on both devices that are terminating the Phase 1 IKE tunnel that is expected.  Your logs that show the private IP is expected as well because prior to egress the IP address isn't transalated.  If you are sure that both the Juniper and PAN have a publically routable IP address and it's not working then the next step would be to open a support ticket and probably with both vendors. I've seen nothing in this thread that tells me either the PAN or the Juniper is the culprit so a support ticket with both vendors would be the way to go depending on the software you are running.  If you are running a GA release of PAN-OS then you can definitely open a support ticket with PAN support as well.  ... View more

I misunderstood the private IP being from the PAN so that log is correct. If the public IP addresses are correct then it may go back to what Warby said in the previous post about an identifier. You may need to try a peer identifier. This link is just to illustrate the peer identifier setup. https://live.paloaltonetworks.com/t5/Configuration-Articles/IPSec-VPN-Tunnel-with-Peer-Having-Dynamic-IP-Address/ta-p/94161 ... View more

We should never see the private IP address is Phase 1 as this is where the peers are authenticated. If the Juniper doesn't have a routable public IP address then you need to be in aggressive mode on the PAN VM-Series for your VPN setup. At this point I wouldn't deem this an issue with VM series firewall itself. My suggestions here are   1. Figure out why your Juniper Private IP is being sent to the PAN VM-Series firewall 2. If the Juniper doesn't have a static IP address then configure the VM-Series in Aggressive Mode.  ... View more

what type of error does the IKEMGR log show on the PAN firewall? you can see that by running  less mp-log ikemgr.log or something of that effect.  Also out of curiosity check the ENI that is used for the VPN termination point on the VM series and see if Source Destination checks is turned on. If so as a test turn that off.  ... View more

PAYG2 will have support for URL Filtering https://live.paloaltonetworks.com/t5/AWS-Azure-Articles/VM-Series-for-AWS-and-Azure-Licensing-Considerations/ta-p/125552   If all you need to do is create a customer URL category and define the URLs then you shouldn't need a URL filtering license for that. But if you want URL filtering then PAYG2 is the way to go there.  ... View more

I'm not sure about Junipers but on our devices when you see "00000000" in the log for your peer that means it doesn't recognize it or have a way to route back to it. It amost looks as if something is NAT'ing out for your firewalls untrust interface. Can you ensure that your PAN firewalls Untrust interface is reachable via internet? easiest way to do that would be to add a management profile to your Untrust interface for ping. If you can successfully do this be sure you have provided the correct IP addresses.    ... View more

In a situation like this you can spin up a Palo Alto Networks VM series firewall in AWS and use the firewall as the VPN termination point to connecct to your on prem PA-3050. You can also use AWS VPN connection as well as the VPN termination point in AWS. Using Global protect VPN connectivity would be limited to the one Global protect client that is connected. If only one person needs to connect then you can do that but you will still need a VM series firewall in AWS to terminate the Global Protect VPN      ... View more

Nithin,    To start we need to a bit more about your configuration and topology. You mention 20 load balancers and also some classic load balancers also. just from that statement I am assuming the 20 AWS load balancers are all ALB is this correct? Are all these load balancers in the same AZ? Can you provide a detail of your architecture so we can understand what you are lookingn to accomplish? Also when you say you are not receiving the expecfted behavior, please elaborate on what type of behavior you are receiving? What is the difference in the traffic source per load balancer?  Also the ethernet swap must happen whether using Application LB's or Classic LB's because Dataplane traffic has to be received on Eth0. See link below for Details.  https://www.paloaltonetworks.com/documentation/80/virtualization/virtualization/set-up-the-vm-series-firewall-on-aws/auto-scale-vm-series-firewalls-with-the-amazon-elb/what-components-does-the-vm-series-auto-scaling-template-for-aws-deploy     Management Interface Mapping for Use with Amazon ELB https://www.paloaltonetworks.com/documentation/80/virtualization/virtualization/set-up-the-vm-series-firewall-on-aws/about-the-vm-series-firewall-on-aws/management-interface-mapping-for-use-with-amazon-elb#id7e1c2653-88af-4a85-8bb8-aae1847c0d9f   Just off the top of my head you have to be sure to select the appropriate subnet for the firewall eth0 BUT the eth0 interface has to be swapped.  Also how are you swapping the ENI's? Please answer these questions and provide a diagram of what you are looking to accomplish as well. Once I receive that I can take a look at it and we can go from there. Thanks Nithin. ... View more

What exactly does "done by palo alto support" mean?   Can you please provide a case number? ... View more

run this command to see the IP listed >debug dataplane show dos block-table Run this command to the remove the IP. As of now I don't see a way to remove only the individual IP address. Being that these are blocked for a period of time you are less likely to have more than one IP blocked at the same time but if so this will release all of them. Then they must meet the threat criteria to be blocked again. Hope this helps >debug dataplane reset dos block-table UPDATE Just test and this is how you unblock the individual IP >debug dataplane reset dos zone L3_Untrust block-table source x.x.x.x After running this command you may need to find the actual  session and clear it from the "Discard" State admin@PA-200> show session all filter source x.x.x.x -------------------------------------------------------------------------------- ID          Application    State   Type Flag  Src[Sport]/Zone/Proto (translated IP[Port]) Vsys                                          Dst[Dport]/Zone (translated IP[Port]) -------------------------------------------------------------------------------- 45629        ssh            DISCARD FLOW       x.x.x.x[36437]/L3_Untrust/6  (x.x.x.x[36437]) vsys1                                          10.0.0.5[22]/L3_Untrust  (10.0.0.5[22]) admin@PA-200> clear session id 45629 ... View more

Based on the previous thread it looks like you are having commit issues. Although we do have some improvements in the commit process that improve commit time in 6.1, and the amount of data parsed when committing, we  do have plenty that are using those platforms with PAN-OS 6 that aren't experiencing those issues. They may experience long commit times which is common on 1 Gent platforms due to other reasons but if you are failing 70% of the time that's a problme. If you still have support which is sounds like you do you may want to open a support ticket however if you have worked with support you may want to consider 6.1.PAN-OS 6.1 doesn't have to parse everything in each commit which can drastically shorten the commit time improve the commit success rate. If you chose to move to a 6.1.x version I would wait until 6.1.3 is released.   Also you shouldn't have any issues rolling back. Always save your configuration and maybe even export your device state periodically as well. ... View more

Quick Question for you. Are you on a 2K Platform that is experiencing the issue? What version of PAN-OS are you running and what issues are you experiencing exactly? ... View more