About BPry

I believe that the only way to do this properly would be to setup LAN,WAN, and VOICE interfaces on your PA500 and then setup the DHCP for the interface, I believe that you can only have one DHCP scope on any particular interface.    PS. If they are running on 7.1.0 I would upgrade them to 7.1.5 and get the latest code; they have made a lot of bug fixes since 7.1.0.  ... View more

Gotcha, static routes are going to be the only way to accomplish this. Set the static routes and create the relevent security policies and you'll be good to go.  ... View more

I believe that @reaper may be able to confirm, but I seem to recall a discussion taking place that said that this was true. The latest GlobalProtect releases you needed to be running a portal on 7.1 for it to function correctly.  ... View more

If your looking to pass traffic between VRs then you need to setup the static routes that would allow you to do so; if you don't have a reason to seperate out your network traffic I'm a little confused why you would use multiple VRs in the first place.  ... View more

I more wanted to get a idea of how physiable it was going to be for our organizaiton. Our manager will handle actually getting the quote and making any purchase decisions. I just wanted to know how much time I should actually dedicate to learning the Traps management console.  ... View more

Thanks! Ya that sounds like a no go ... View more

I believe that the assumption is that while the PA-200 may be setup on a shelf in an office, where you would want the fans spinning up only if they actually need to be, everything larger would likely be mounted in a rack and put in a data closet or a DC. To my knowlege there is no fan controller onboard any of the larger units, meaning that the fan is either on an on or off state.  ... View more

It doesn't really look like they dragged their feet at all; they were simply pointing out that if you are not running in a HA pair the 4 hour replacement option would probably fit your deployments a little better. It might come across a little 'salesman' like but I would actually call it a really great idea for anybody not running HA devices.  ... View more

I'm not seeing any PCAPs but I can load this website on my end perfectly fine; so I don't think MTU would be the issue unless you have changed it from default on your end for some reason. Also keep in mind that depending on your ISP changing the MTU on your end may not actually be doing anything, the ISP can controll the MTU on their link so if you suspect it to be MTU make sure that they aren't monkeying around with that after it leaves your network.  ... View more

O.O That makes way more sense actually, I was under the impression that you had made a vwire with just a single Aggregated interface, which shouldn't work. It makes way more sense now.    I wouldn't be to worried about support unless you actually have an interface issue, if they have to look at your interfaces for something then I would expect that they would just tell you that the way you have them configured is causing your issue. Also as a side note I wouldn't be to suprised if they simply said that was your issue whenever they noticed it while investigating a support ticket; as it would be an easy step to eliminate and it isn't a supported configuration they will probably have you fix it before they continue to troubleshoot anything else.  ... View more

If this is actually working then it would by no means be supported by PA. It would be interesting to know what version of PANos your actually running, as this probably shouldn't have commited as vwire needs at least two interfaces to function correctly. Out of curiosity what is the benefit of running vwire in this scenario; wouldn't it make more sense to run with a layer2/3 interface and avoid the vwire all together? ... View more

I guess what I meant as an 'any any' rule was that it would be any destination and any applicaiton. This placed above all other security rules will let you know if this is a firewall issue or a network issue. If you still can't get to Skype with a set source address, any destination, and any application set to allow then it would indicate that your firewall isn't at fault here; something in front of your firewall is to blame for the issue.  ... View more

I would test with a single source IP address allocated an 'any any' rule without any blocks in place and see if you still recieve the error. That would at the very least tell you if it's actually a rule issue. If that works I would request a config export since it seems like you are working with someone offsite and don't have direct access to the equipment.  ... View more