About OtakarKlier

Hello, Sorry for not clarifying, What I meant to say is 'if' there are any errors work through those during the commit phase. BPry did a better job of explaining it than I did :). Regards, ... View more

Hello, I'm facing a similar issue and havent had a chance to look into it. I'll post when I find something. Regards, ... View more

Hello, I'll try to break down the different questions, please let me know if I missed something: 1. YES backup the config as enabling fips wipes the config. There is no other special setting to change on the config. Just work through any errors you get. I've done this a few times so know its possible. Obviously get approval in writing and change control, etc. 2. If you dont use RADIUS, dont worry about this. you can use local auth etc. 3. Sorry no there is no other way :(.   Just remember again to backup your config! Regards, ... View more

Hello, For your policy based routing, make sure the Monitor is enabled as well as Enforce Symmetric return. The for the secondary tunnel, just add a static route in the virtual router. The Policy base forward rules take effect prior to the virtual router so the policy when enabled will always be preferred. If it goes down due to the monitor, the PAN will disable the policy and the static route takes over. Regards, ... View more

Hello, Looks like several issues according you your screenshot: 1. The highlighted zone needs to be the internal zone the IP 192.xx.xx.xx lives in   2. The firewall reads policies top down left to right so your policy 7 will block all traffic and never hit policy 8 (just move policy 7 to the bottom. Also change the highlighted zone to the internal zone the 192.xx.xx.xx system lives in.   Regards, ... View more

Hello, I do this a different way using either Policy Based Routing or OSPF, even static routing will work. Build your two tunnels. Then do one of the following: 1. Create a Policy Based Forward policy to send the traffic down one tunnel and check the box "Enforce Symetric Return' and Monitor. 2. Setup OSPF and add a metric to the secondary tunnel of like 10000. then OSPF will direct the traffic the correct path that is up, etc. 3. User static routes with path monitoring   Regards, ... View more

Hello, Set all security policies to log at session end. Check the traffic logs to see why the traffic is getting denied. Since its SIP traffic, its going to be UDP so you'll have to check the 'Session Browser' to see the traffic before it times out. Regards, ... View more

Hello, Are you sourcing your ping from the management interface? What does the logs show? Most likely causes: 1. Security policy incorrect 2. Nat policy incorrect 3. Missing routes in virtual router. Setting all policies to log at session end should allow you to see all the traffic the data plane sees, allowed and denied. Regards, ... View more

Hello, My guess is that there is a missing or misconfiguration in one of the following: Virtual router, security policy, NAT policy.   Regards, ... View more

Hello, You should be able to, however make sure your routing is set so that its not going to use multiple tunnels unless you are using ECMP. Regards, ... View more

Hello, I would use /32 addresses. This way you control which interface/direction the traffic is flowing. Regards, ... View more

Hello, Which options, the VPN tunnels? What manufacturer is the other endpoint? Regards, ... View more

Hello, Is a watchguard a route based or zone based firewall? Palo Alto is route based. Regards, ... View more

Hello, I think your answer would depend on how you plan to use the tunnel interfaces. You can assign multiple IP's to a singe interface. However for me, I use the interfaces for OSPF routing and to see if the tunnel is up, via 3rd party monitoring since the tunnels connect via different providers. Regards, ... View more