This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences

About rmfalconer

cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.
rmfalconer
‎04-22-2024
since ‎02-06-2017
L5 Sessionator
User Activity
User Profile
Latest posts by rmfalconer
View All
User Badges
Community Statistics
Member Since ‎02-06-2017 10:18 AM
Date Last Visited ‎04-22-2024 05:58 PM
Posts 283
Total Likes Received 48

Re: Certificate revocation / OCSP not working

by in Next-Generation Firewall Discussions
‎10-21-2022 08:35 AM
‎10-21-2022 08:35 AM
I believe it uses whatever interface you define in the OCSP responder section. Is that where you've defined the management interface? ... View more

Re: BGP AS-Path allow

by in General Topics
‎10-20-2022 01:19 PM
‎10-20-2022 01:19 PM
With eBGP, the default option when creating a peer on the PA is to remove private AS. Is eBGP being used on the PA with the other devices and other AS are private? ... View more

Re: Active-Active Firewall - BGP failure condition

by in General Topics
‎10-20-2022 09:07 AM
‎10-20-2022 09:07 AM
Is the expectation that BGP to the provider goes down on A-P that traffic will then go to A-S? I assume you've preferenced the prefix(es) learned through A-P so that's the better path from your internal gear. When BGP on A-P goes down, those prefixes should be withdrawn and traffic goes to A-S. Sounds like that's happening. What does the routing table look like on A-S when BGP is down on A-P?  What does a traceroute show?  ... View more

Re: BGP AS-Path allow

by in General Topics
‎10-12-2022 09:02 AM
‎10-12-2022 09:02 AM
So are you looking for the PA to prepend AS to the path? That's definitely possible in any version of PAN-OS. Export rule actions have specific AS path options for prepend, remove and remove + prepend. ... View more

Re: Certificate export on a fips enabled firewall

by in Next-Generation Firewall Discussions
‎10-06-2022 04:35 PM
‎10-06-2022 04:35 PM
Where did the current certificate come from? Are you doing certificate checks on the endpoints now? ... View more

Re: L2 Extensions

by in General Topics
‎06-08-2022 02:07 PM
‎06-08-2022 02:07 PM
Where are the gateways now? What's going to terminate the GRE tunnel on the client side? ASA doesn't support GRE.  ... View more

Re: datapalne issue

by in General Topics
‎06-06-2022 01:35 PM
‎06-06-2022 01:35 PM
Can you confirm the version you're using? ... View more

Re: L2 Extensions

by in General Topics
‎06-06-2022 10:02 AM
‎06-06-2022 10:02 AM
How do the broadcasts from the clients traverse the IPSEC tunnel? The ASA can use policy or route-based VPN but I don't think either will have a mechanism to allow broadcasts. Without that, the clients won't be able to find their gateways. Why do the gateways need to be on the PAN? ... View more

Re: Palo Alto rejecting one route

by in General Topics
‎05-31-2022 09:08 AM
‎05-31-2022 09:08 AM
The PAN didn't place it's own AS in the path, that was inserted along the way. It looks like 10.240 was originated by AS 65201, which peers with AS 65200. Is there another 65200, or another device besides the PAN in 65200? ... View more

Re: Palo Alto rejecting one route

by in General Topics
‎05-26-2022 08:05 AM
‎05-26-2022 08:05 AM
In Monitor-Packet Capture, you could start a capture on a specific interface, with filters for the BGP peer.  Then reset the BGP peer so that you can generate some fresh traffic for the capture and logs. If you go through the capture in Wireshark, you can find which prefixes are being sent from the peer.   You might find something interesting with these at the CLI: show log system direction equal backward subtype equal routing less mp-log routed.log ... View more

Re: Palo Alto rejecting one route

by in General Topics
‎05-25-2022 05:04 PM
‎05-25-2022 05:04 PM
Have you looked at routed.log or run any debugs or captures? The captures could verify you're receiving the prefix and the log may show why it's not being installed. If the advertising device of 10.240.0.0 is an ibgp neighbor, is 'next-hop-self' configured? Maybe the advertised next hop for 10.240.0.0 isn't reachable by the PA?    ... View more

Re: Palo Alto rejecting one route

by in General Topics
‎05-24-2022 07:58 PM
‎05-24-2022 07:58 PM
Do you have 10.240.0.0/16 allowed on an import list? That doesn't fall in 10.0.0.0/16. ... View more

Re: How to use Seprate IPs on WAN interface of 2 Paloalto Firewall.

by in General Topics
‎05-23-2022 08:27 AM
‎05-23-2022 08:27 AM
You need the redundant circuit connected to both PAs, just like the primary.  Interface configuration and routes sync between active and passive nodes. Link - What doesn't sync between active/passive  Then you'll need to choose how to utilize both circuits during normal operation and during failover. ... View more

Re: How to use Seprate IPs on WAN interface of 2 Paloalto Firewall.

by in General Topics
‎05-23-2022 08:15 AM
‎05-23-2022 08:15 AM
Why do A/P HA devices need different routes? ... View more

Re: Can't advertise static route over ebgp

by in General Topics
‎05-17-2022 08:20 PM
‎05-17-2022 08:20 PM
As a test, did you try without a redistribution profile? In redist rules, you can just free type the prefix you're trying to redistribute, x.x.x.x/m, and click enable.  ... View more
Register or Sign-in
Contact Me
Online Status
Offline
Date Last Visited
‎04-22-2024 05:58 PM
Latest Tags
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2024 - Palo Alto Networks