About kprakash

You can use just one VR itself, even  if you are multihomed with ISP 1 and ISP 2. All you need is to influence the routes using the BGP attributes ( local preference, the AS hops, or origin ). For  and I would prefer the local preference as the primary factor for the influencing the outbound routes. You can continue using the /24 addresses on the external interfaces itself, and since they are assigned to you by your ISPs ( hence being advertised too ), users have a route to reach any IP address on this /24 subnet.  You can write destination NAT rules for any IP address that fall within the /24 range and the firewall will proxy arp for these IP addresses. Please let me know if you have any questions. For design considerations, you can also talk to your Sales Engineer or get in touch with the Dev Centre team. BR, Karthik ... View more

To be more specific: admin@46-PA-4020> show routing protocol bgp peer admin@46-PA-4020> show routing protocol bgp peer   ==========   Peer:                          peer1.4.1 (id 2)   virtual router:                vr1   Peer router id:                192.168.1.4   Remote AS:                     65002   Peer group:                    peer1.4 (id 2)   Peer status:                   Established, for 2946 seconds   Password set:                  no   Passive:                       no   Multi-hop TTL:                 2   Remote Address:                10.10.10.4:57911   Local Address:                 10.10.10.1:179   (R) reflector client:          not-client   same confederation:            no   send aggr confed as-path:      yes   peering type:                  Unspecified   Connect-Retry interval:        120   Open Delay:                    0   Idle Hold:                     15   Prefix limit:                  5000   Holdtime:                      90 (config 90)   Keep-Alive interval:           30 (config 30)   Update messages:               in        1, out        1   Total messages:                in      115, out      115   Last update age:               3   Last error:                      Flap counts:                   1, established 1 times   (R) ORF entries:               0   Nexthop set to self:           no   use 3rd party as next-hop:     yes   override nexthop to peer:      no   ----------   remove private AS number:      yes   ----------   Capability:                    Multiprotocol Extensions(1)  value: 00010001   Capability:                    Route Refresh(2)   Capability:                    Graceful Restart(64)  value: 007800010100   Capability:                    Route Refresh (Cisco)(128)   ----------   Prefix counter for:            IPv4 / unicast   Incoming Prefix:               Accepted 0, Rejected 0, Total 0   Outgoing Prefix:               0   Advertised Prefix:             0   ==========   Peer:                          peer1.3.1 (id 1)   virtual router:                vr1   Peer router id:                192.168.1.3   Remote AS:                     65001   Peer group:                    peer1.3 (id 1)   Peer status:                   Established, for 3657 seconds   Password set:                  no   Passive:                       no   Multi-hop TTL:                 2   Remote Address:                192.168.1.3:34865   Local Address:                 192.168.1.1:179   (R) reflector client:          not-client   same confederation:            no   send aggr confed as-path:      yes   peering type:                  Unspecified   Connect-Retry interval:        120   Open Delay:                    0   Idle Hold:                     15   Prefix limit:                  5000   Holdtime:                      90 (config 90)   Keep-Alive interval:           30 (config 30)   Update messages:               in        1, out        1   Total messages:                in      143, out      143   Last update age:               27   Last error:                      Flap counts:                   1, established 1 times   (R) ORF entries:               0   Nexthop set to self:           no   use 3rd party as next-hop:     yes   override nexthop to peer:      no   ----------   remove private AS number:      yes   ----------   Capability:                    Multiprotocol Extensions(1)  value: 00010001   Capability:                    Route Refresh(2)   Capability:                    Graceful Restart(64)  value: 007800010100   Capability:                    Route Refresh (Cisco)(128)   ----------   Prefix counter for:            IPv4 / unicast   Incoming Prefix:               Accepted 0, Rejected 0, Total 0   Outgoing Prefix:               0   Advertised Prefix:             0   ==========   Peer:                          peer1.3.1-vr2 (id 1)   virtual router:                vr2   Peer router id:                192.168.1.3   Remote AS:                     65001   Peer group:                    peer1.3-vr2 (id 3)   Peer status:                   Established, for 2191 seconds   Password set:                  no   Passive:                       no   Multi-hop TTL:                 2   Remote Address:                10.10.10.3:179   Local Address:                 10.10.10.2:42688   (R) reflector client:          not-client   same confederation:            no   send aggr confed as-path:      yes   peering type:                  Unspecified   Connect-Retry interval:        120   Open Delay:                    0   Idle Hold:                     15   Prefix limit:                  5000   Holdtime:                      90 (config 90)   Keep-Alive interval:           30 (config 30)   Update messages:               in        1, out        1   Total messages:                in       87, out       87   Last update age:               25   Last error:                      Flap counts:                   0, established 1 times   (R) ORF entries:               0   Nexthop set to self:           no   use 3rd party as next-hop:     yes   override nexthop to peer:      no   ----------   remove private AS number:      yes   ----------   Capability:                    Multiprotocol Extensions(1)  value: 00010001   Capability:                    Route Refresh(2)   Capability:                    Graceful Restart(64)  value: 007800010100   Capability:                    Route Refresh (Cisco)(128)   ----------   Prefix counter for:            IPv4 / unicast   Incoming Prefix:               Accepted 0, Rejected 0, Total 0   Outgoing Prefix:               0   Advertised Prefix:             0   ==========   Peer:                          peer1.4.1-vr2 (id 2)   virtual router:                vr2   Peer router id:                192.168.1.4   Remote AS:                     65002   Peer group:                    peer1.3-vr2 (id 3)   Peer status:                   Established, for 2188 seconds   Password set:                  no   Passive:                       no   Multi-hop TTL:                 2   Remote Address:                192.168.1.4:179   Local Address:                 192.168.1.2:40043   (R) reflector client:          not-client   same confederation:            no   send aggr confed as-path:      yes   peering type:                  Unspecified   Connect-Retry interval:        120   Open Delay:                    0   Idle Hold:                     15   Prefix limit:                  5000   Holdtime:                      90 (config 90)   Keep-Alive interval:           30 (config 30)   Update messages:               in        1, out        1   Total messages:                in       86, out       88   Last update age:               7   Last error:                      Flap counts:                   0, established 1 times   (R) ORF entries:               0   Nexthop set to self:           no   use 3rd party as next-hop:     yes   override nexthop to peer:      no   ----------   remove private AS number:      yes   ----------   Capability:                    Multiprotocol Extensions(1)  value: 00010001   Capability:                    Route Refresh(2)   Capability:                    Graceful Restart(64)  value: 007800010100   Capability:                    Route Refresh (Cisco)(128)   ----------   Prefix counter for:            IPv4 / unicast   Incoming Prefix:               Accepted 0, Rejected 0, Total 0   Outgoing Prefix:               0   Advertised Prefix:             0 ... View more

Hello, The router ID is used just as an identifier. For example in the below output, you can see that the routed ids are 192.168.1.1 and 192.168.1.2 respectively. However, the PANFW establishes the BGP connectivity with peers 10.10.10.4 (local address: 10.10.10.1 ), and 192.168.1.3 (local address 192.168.1.1 ) on VR1. Similarly on VR2 the router id is 192.168.1.2, and it establishes the BGP connectivity with peers 10.10.10.3 ( local IP address 10.10.10.2 )  and 192.168.1.4 ( local IP address 192.168.1.2) dmin@46-PA-4020> show admin@46-PA-4020> show routing admin@46-PA-4020> show routing protocol bgp admin@46-PA-4020> show routing protocol bgp summary   ==========   router id:                     192.168.1.1   virtual router:                vr1   reject default route:          reject   redist default route:          block   Install BGP routes:            no   Graceful Restart:              supported   AS size:                       2   Local AS:                      65000   Local member AS:               0   Cluster id:                    0.0.0.0   Default local preference:      100   Always compare MED:            no   Aggregate regardless MED:      yes   Deterministic MED processing:  yes   Accept ORF:                    no   Accept CISCO style prefix:     yes   rib-out entries:               current 0, peak 0     peer peer1.4.1:              AS 65002, Established, IP 10.10.10.4       IPv4/unicast pfx:          Accepted pfx: 0, Advertised pfx: 0     peer peer1.3.1:              AS 65001, Established, IP 192.168.1.3       IPv4/unicast pfx:          Accepted pfx: 0, Advertised pfx: 0   ==========   router id:                     192.168.1.2   virtual router:                vr2   reject default route:          reject   redist default route:          block   Install BGP routes:            no   Graceful Restart:              supported   AS size:                       2   Local AS:                      65008   Local member AS:               0   Cluster id:                    0.0.0.0   Default local preference:      100   Always compare MED:            no   Aggregate regardless MED:      yes   Deterministic MED processing:  yes   Accept ORF:                    no   Accept CISCO style prefix:     yes   rib-out entries:               current 0, peak 0     peer peer1.3.1-vr2:          AS 65001, Established, IP 10.10.10.3       IPv4/unicast pfx:          Accepted pfx: 0, Advertised pfx: 0     peer peer1.4.1-vr2:          AS 65002, Established, IP 192.168.1.4       IPv4/unicast pfx:          Accepted pfx: 0, Advertised pfx: 0 Hope that helps, BR, Karthik RP ... View more

Please contact your Sales Engineer or the Dev Centre team to assist you with the migration. In order for you to run the VPNs on the PANFW, you have to convert the vwire to layer 3 interface mode. Best regards, Karthik RP ... View more

I would check the HA1 link first. At the same time, we also want to verify if the upstream/downstream switches did receive and process the gratuitous arps whenever there was a failover. If the cluster is an active-passive setup, the passive device shouldnt transmit any traffic from the upstream/downstream switches. BR, Karthik ... View more

You can leverage the single sign on feature, so when the laptop having the agent on it, connects within the network and has been  successfully authenticated, a VPN tunnel gets established and he can go out to the internet via the tunnel. If he fails to get authenticated, the user will get identified as an unknown user, and we can configure a rule to block all unknown users. That way he cannot get access to the internet, although he is connected internally in the network. Like Gregoux mentioned as well, you can use the hip checks to deny access to the machines if they do not match a config criteria. BR, Karthik RP ... View more

Is it just the VPN traffic that is having this issue or other traffic that suffer from the same problem? like people complaining about slow web browsing. Plus correct me if I am wrong, but is this an active passive setup? BR, Karthik RP ... View more

There might be an issue with the HA1 link. HA1 link is the control link and is used for all management plane interactions between the members of the cluster. If the HA1 is faulty, each device would assume that its peer is no longer in cluster and tries to assume the mastership of the cluster. Please reseat the cables or change them to see if it makes a difference. BR, Karthik RP ... View more

Can you elaborate more upon the requirement. Your question isn't very  clear. BR, Karthik ... View more

Good Morning, If you are talking about a user who wants to connect to an internal gateway, we can configure the PANFW gateway on a VPN tunnel with in the office as well. By default the PANFW supports the SSL connection to the GP users ( whether connected internally or externally), and we have to manually configure the gateways to accept a  VPN connection. You can find the information on the below thread: https://live.paloaltonetworks.com/message/29549#29549 Hope it helps, BR, Karthik ... View more

We can enable tunnel monitoring so that there is at least some traffic flowing through the tunnel. ( tunnel monitoring forces the firewalls to rekey ). The system logs on the PANFW is the best place to look for the reasons the tunnel going down. Similarly the kmd logs ( >show log kmd )  on the Juniper ( if its an SRX ) will give you the reasons for the tunnel to go down. BR, Karthik RP ... View more

Good Afternoon, Looking at the setup, we have two options to accomplish the seamless traffic flow, when changing the IP address and gateway on the client machines. Since there are 2 switches connecting upstream and downstream to the PANFW and having vlans configured under it ( they appear to be trunked ports), the easiest way to accomplish the routing is to 1) Configure the PANFW with the virtual wire setting, and passing all tagged traffic under it. With this setting the PANFW passes the frames of each of the vlan traffic, and once they reach the swtiches, the switches take the corresponding forwarding decision. To configure the PANFW as a vwire and pass the vlan tagged traffic, look follow the below link https://live.paloaltonetworks.com/docs/DOC-2729 2) Another way is to configure the interfaces, connecting the upstream and the downstream switchports, as trunked ports on the PANFW and passing all the vlans part of the trunk. You may or may not configure the vlan interfaces for these vlans, as it would make more sense having the default gateway for the PCs configured under the upstream switches. Ensure that when you have layer 2 interfaces configured, you still have to assign them to a virtual router and a zone to pass the traffic Hope that helps. BR, Karthik RP ... View more

Thats an easy test to begin with. But you will only be able to test minimal traffic between the 2 laptops. The real load test would be when you pass pre-production traffic, with the PANFW, inline with the netwok ( before you replace your existing firewall with the PANFW ), without disturbing your existing layer 3 setup. ------------ internal networl---------- inside vwire inter-------------PANW----------outside vwire interface -------------router/firewall---------internet cloud The PANFW will act as an IPS, process the traffic, matching for the applications and looking for threats. BR, karthik ... View more