About BBartik

BBartik · ‎07-13-2024

So the virtual ion is behind a palo FW and the session state was stale I think. I cleared the session from the Palo and the tunnel came up.

BBartik · ‎07-13-2024

I have 2 sites, each with a virtual ION. Each has 2 WAN interfaces, behind NAT, and a pair of tunnels to Prisma Access. Site1 is fine and both tunnels are up. Site 2 was fine but at some point one of the tunnels went down. I cannot figure out what could be the issue as their appears to be limited logging or IKE/IPsec debugging. I can see the from the CLI the down tunnel is in the "tunnel_bring_up" state. Internet from both interfaces works and I can ping tunnel endpoint from either WAN interface. These tunnels were auto created using the "Connect to Prisma Access" feature and both have the same tunnel endpoint IP. Site 1 is configured in a similar fashion and is up. Any ideas where to look next?

BBartik · ‎06-19-2024

Worked great, thank you!

BBartik · ‎06-08-2024

So the issue was a user error. I created the cert via openssl but had not imported the private key into the store along with the cert. Doh!

BBartik · ‎06-08-2024

I am testing client auth using certificates and the certificate is not being retrieved from the User store. It's Windows 11. The PanGPA.log file shows this error: (P23516-T9764)Debug(2744): 06/08/24 11:07:10:562 box return Valid client certificate is required, remove cache and close all handle now (P23516-T9764)Debug(5570): 06/08/24 11:07:10:562 we get cert error, so remove previousCertificate (P23516-T9764)Debug(5528): 06/08/24 11:07:10:562 send alive message now 2 (P23516-T9764)Debug(5165): 06/08/24 11:07:10:562 client certificate error found: Client cert usage check failed My cert has the following extensions. Am I missing something else on this cert? X509v3 extensions: X509v3 Subject Alternative Name: email:aa@aaa.com X509v3 Extended Key Usage: TLS Web Client Authentication X509v3 Key Usage: Digital Signature, Key Encipherment

BBartik · ‎08-08-2023

When building an NGFW SDWAN hub-spoke network, SDWAN tunnels are not built between hubs. I was thinking of 2 options: 1) Manually building two tunnels between the hubs and put them in an SDWAN bundle myself, along with the rest of the SDWAN config (static routes to loopbacks over the SDWAN bundle, BGP Peering). Do you foresee any issues with this? It's a lot of config, where I wish auto-vpn just did it for you. Or 2) I could just build tunnels and run BGP over them. Thoughts? How have you approached this?

BBartik · ‎08-02-2023

Same here, waiting for the same fix...

BBartik · ‎03-01-2023

I am trying to make an address group that consist of wildcard addresses but I get this error: vpn30-wc -> static 'vpn30-v110-wc-1' is not a valid reference vpn30-wc -> static is invalid vpn30-v110-wc-1 is an IP Wildcard vpn30-wc is a new empty address group. Is this not supported?

BBartik · ‎02-28-2023

How can I set the zone for a rule to any in the CLI? If I delete the from / to lines it sets it to "none" which is not valid. If I set it to "any" then it thinks "any" is the name of the zone which is also incorrect. Any ideas? Thanks!

BBartik · ‎01-06-2023

The issue was I did not have the proper tplname value. I was using a template name, it should have been the stack name.

BBartik · ‎01-05-2023

I am trying to boot and auto-attach a VM series FW to Panorama in AWS. I am specifying the user-data as follows: type=dhcp-client hostname=aws-palo-1 panorama-server=a.b.c.d tplname=lz-firewall dgname=lz-firewall dns-primary=8.8.8.8 dns-secondary=8.8.4.4 op-command-modes=mgmt-interface-swap dhcp-send-hostname=yes dhcp-send-client-id=yes dhcp-accept-server-hostname=yes dhcp-accept-server-domain=yes vm-auth-key=<omitted> But after the firewall boots it is not attaching itself to Panorama. Is it supposed to connect to Panorama and add itself? What's the point of the vm auth key?

BBartik · ‎09-20-2022

It seems that the issue is when you do a "revert", behind the scenes the firewall is actually deleting the interfaces from where they are and re-creating everything. It can't do delete because there are static routes tied to the interface. You can see this behavior in the config log.

BBartik · ‎02-21-2022

Any luck on this? I am getting a similar error. In my case, it says it needs to delete them even though interfaces exist in the template. My templates and local config match exactly on the network portions so not sure why I am getting this error. I don't want to use Force template values either for reasons you mentioned.

BBartik · ‎12-27-2021

I am deploying Palo Alto SDWAN and the hub currently terminates dedicated L2 WAN circuits for each remote site. My plan is to build tunnels to each site across their dedicated L2 WAN and across the Internet. Example: Palo Hub connects to site 1 on e1/1.100, zone: site1 Palo Hub connects to site 2 on e1/1.200, zone: site2 The current security policies all reference the existing zones: site1, site2, etc. when I build my SDWAN tunnels using autoVPN then tunnels all use "zone-to-branch" zone which is not what I want to use. How can I get the AutoVPN tunnels to use the existing site one names? Is this possible?

BBartik · ‎05-28-2020

I know this is old but I believe the reason for Default is that the object is already part of a group in the ASA. If the SrcFile is equal to the filename, that means expedition has created the objects based on a rule. Example: TCP port 9060 is part of an object group already. When you import the ASA config, Expedition creates a new object and SrcFile shows up as "Default". TCP 9061 is not in an object group but used in a rule. Expedition creates the object and marks the SrcFile as the filename.

Member Since	‎10-30-2016 09:58 PM
Date Last Visited	‎01-25-2026 02:05 PM
Posts	31
Total Likes Received	2

Online Status	Offline
Date Last Visited	‎01-25-2026 02:05 PM

About BBartik

Re: IPsec tunnel to Prisma Access down

IPsec tunnel to Prisma Access down

Re: Deploying Cloud NGFW for Azure using Terraform

Re: Client cert usage check failed

Client cert usage check failed

Connectivity between hubs in NGFW SDWAN

Re: When is PAN-OS 10.2.5 release

IP Wildcard Address not supported in Address Groups?

Set zone to "any" in CLI

Re: Auto-attaching VM series to Panorama in AWS

ICMP Invalid object not replaceable

Re: "Client cert is invalid to the gateway" error

Re: No security policies showing in Expedition project

Prisma Access CloudBlade to Native Integration experience

Deploying Cloud NGFW for Azure using Terraform

Re: Prisma SD-WAN Virtual Bypass Pair On 3108v

Re: When is PAN-OS 10.2.5 release

Re: IPsec tunnel to Prisma Access down

IPsec tunnel to Prisma Access down

Re: Deploying Cloud NGFW for Azure using Terraform

Re: Client cert usage check failed

Client cert usage check failed

Connectivity between hubs in NGFW SDWAN

Re: When is PAN-OS 10.2.5 release

IP Wildcard Address not supported in Address Groups?

Set zone to "any" in CLI

Re: Auto-attaching VM series to Panorama in AWS

Auto-attaching VM series to Panorama in AWS

Re: Palo Alto Template Revert error

Re: Palo Alto Template Revert error

Palo Alto SDWAN zone

Re: Migrating from ASA 8.2 makes double objects and rules

Seattle Beta

Unlock your full community experience!

About BBartik