About jsalmans

@reaper   Yep, pretty sure that was it.  I have a supersceding profile for special users at our campus and it had SSO enabled for some reason.  Disabled that and connected from home and the RDP user is gone.   Thanks! ... View more

Thanks for the replies everyone.   @bradk14 the destination NAT idea came from something we saw on a Live article but I can't seem to find it anymore.  It was a long shot but we thought we had it working... pretty sure Chrome just remembered we'd previously reached the portal on https and just updated hte URL every time we typed it in.   I thought about using a server as you suggest to just have a redirect page set up, however, I wasn't sure how that would work since the portal isn't just a webpage... it's also a connection point for the VPN client.   @ansharma I noticed the 20077 translations as well when examining the sessions in the Traffic Monitor.  I agree that it seems like something specific is being done for VPN behind the scenes that occurs before a lot of the user configurable stuff or like a script blocking anything but https connectivity like you mentioned.   I'm definitely going to reach out to our reps about this.  It seems like a bit of an oversight and, while it isn't a super important feature, it certainly is useful when presenting the portal to end-users.   Thanks ... View more

I noticed when I created an external IP list and applied it as a Source for a NAT rule it was showing up as a "Block List" in the list there.  After looking through some documentation on older PANOS versions I've come to the conclusion that "Block List" is just an old name for External Dynamic Lists and there are probably still some spots where it shows up as such in current versions.  Despite how it was labeled, I was able to use the list as a list of Source IPs to match against for a NAT rule just fine.   I imagine they changed the name for that very reason... you can use them for more than just blocking things in security policies. ... View more

Another update.   As a temporary solution I've created an external list with the reserved private IP addresses for affected devices and created a NAT policy set to Dynamic IP with the source as the external list.   Doing this puts the PS4 devices on "Type 2 Moderate" NAT.  The XBox One devices still say Type 1 Open NAT but do not seem to be getting disconnected after only a minute or two in a peer to peer game.   I consider this more of a workaround than a long term solution... I'd still like to find out why DIPP isn't working for this and if there is anything to be done about it.  We may be doing a network maintenance on Friday for a connected device so I may try to suspend one of the active firewalls to try to determine if this has anything to do with the active/active configuration or how I have the shared NAT set up between them. ... View more

@BPry I'm looking at an active PS4 session right now and I'm seeing mostly aged-out on UDP traffic.  It looks like the UDP traffic is mostly unknown-udp, stun, and rtp-base.  Most of the TCP traffic seems to be ssl and Playstation Network but those are getting tcp-fin, tcp-rst-from-server, and tcp-rst-from-client.  I am seeing some aged-out on TCP but I believe that was while we were in the game menu.  This is while playing Overwatch which seems to be working just fine, including recieving voice chat.   I think the gaming/voice issues must revolve around P2P games.  The XBox is showing Type 1 Open NAT but gets disconnected after only a minute or two of play on a P2P game.  The Teredo sessions are showing aged-out but the age varies... some show longer than 30 seconds.   I do see some drops coming in from one of the IPs the Teredo established to as they're hitting an incoming drop rule we have but presumably that would only be happening if the remote device was trying to initiate new connectivity to the console.  We don't have incoming ports from the internet open to much of anything except external facing services nor did we on the ASA. ... View more

@jvalentine I received a few reports back today from Xbox One users and, apparently, their devices are actually showing Type 1 Open NAT which surprised me.  If you're correct and there is an ALG in effect then the issue I've been describing may be related only to the XBox Live PC application, various PC games and game platforms that utilize voice chat, and the PS4 consoles.   Apparently the tickets I've been getting for XBox consoles are about getting disconnected from games and party chat... still might be a NAT problem or perhaps a session timeout.  I'm trying to get ahold of an XBox One to continue testing and I'll be sure to try to find the session state information for the PS4 tomorrow. ... View more

That would probably be a pretty useful feature in the interface.   I also just found this: https://live.paloaltonetworks.com/t5/Migration-Tool-Discussions/Best-practice-for-object-cleanup/td-p/41514   I personally like the last mention on that thread about using the Migration Tool.  You can export a config copy from your firewall and load it up in that... gives you some really nice information even if you're not planning on migrating to anything. ... View more

@BPry Yesterday when I was working on it (i.e. playing a game... sometimes I love my job) I had the session browser open on one of the firewalls and I saw active sessions for SIP and some other protocols.  Since we just put this thing in place I'm still learning now that we have real traffic passing through and I'm relying on my training course I took a year ago.   @jvalentine I'm going to have someone look into this today.  I know we've gotten complaints about Strict NAT on the XBox Live App but that is actually running on a PC.  I just browsed the tickets I have and most of them for XBox are talking about disconnects during online games (which may or may not be related) and I haven't found one that specifically mentions the NAT type. ... View more

Hi jvalentine,   So far we've gotten complaints for XBox, PS4, and some gaming applications/platforms on PC.  I'd have to look to see if we've gotten any tickets for Nintendo platforms.   Completely agree about UPNP but I'm pretty certain the Cisco ASA 5580 we previously had deployed didn't supported UPNP either (it would be very strange if it had).  While I had not personally tested a gaming platform on campus beforehand, the complaints only started after we deployed the Palo Alto.   I'll make sure we get our hands on an XBox so we can test internally with that as well. ... View more

Thanks for the reply so far guys.   The active/active deployment was originally chosen by our previous network admin and I continued on the deployment after they left.  We have dual-homed 10gig connectivity from our provider and our traffic can take either connection going out depending on the route.  We're not using even a single full 10gig connection yet so it probably doesn't really matter at this time but the idea was to have the capacity for the full 20gig use if needed down the line.  Of course if we have a failed piece of hardware at some point it may result in degraded service but probably only if we're utilizing over 10gig of bandwidth at that time.  So far everything seems OK with the deployment other than that the way I'm currently advertising our NAT IP addresses are just an OSPF export rule facing our edge router so each firewall sees a route to the other one.   This hasn't seemed to effect incoming traffic though.   I've been testing with my PS4 and, so far, the only way I've gotten a Type 2 is to set it's NAT to a Dynamic IP pool.  The DIPP pool gives it Type 3 Strict every time.  The current rule I'm testing is a reserved DHCP address for the PS4 and it is NATed with a DIPP pool of a single public IP.  Even with this I'm getting Type 3.   BPry, if you've gotten this to work with DIPP is the thought that it might be something to do with the Active/Active?  My DIPP NAT rules are configured with the same 4 IP addresses for each PAN box for complete failover (i.e. no dropped incoming packets in case of a single firewall outage since both firewalls have the same NAT rules with all of the 4 IPs per building).   I've been thinking that our UDP session timeout on the ASA was modified to be much longer than the default on the PAN boxes (30 seconds) or that perhaps Cisco's implementation of PAT was a bit more sticky a far as what ports each device got each time it established a new session.   ... View more

Hi BPry,   I'm on 7.1.8 currently,  The Commit link itself is removed after I told the role I didn't want it to be able to commit or validate but the little lock icon is still there.   I figured I missed something in the role but I don't see anything else to remove or put at read only... the only stuff left I believe are the Dashboard, ACC, and Monitoring tabls along with their sub-items.   Thanks, Jason Salmans ... View more