About VinceM

VinceM · ‎08-27-2019

Hi, Ping is neither TCP nor UDP, it's protocol 1 then I think you are unable to configure your own service. In some fw you can find port 0. Rgds V.

VinceM · ‎03-19-2019

Hi Justin, Start to upgrade the passiv one first. Then you will save on failover 🙂 After compltion of all upgrade path on the passiv one, failover, test the new release during couple of days then, if test is ok, upgrade the other cluster's member else downgrade the fw. Carefull: during this procedure, freeze your configuration. Hope help. v.

VinceM · ‎09-24-2018

Hi Following @Remo remark. @Marivi have you got more GP user than IP adress in the pool ? V.

VinceM · ‎09-24-2018

Hi, If config shown on the link is the same as in your prod make theses change no DES or 3DES, no SHA1. Which have have you got in your palo monitor / System tab ?? V.

VinceM · ‎09-24-2018

Hi, On my side it works. Which version have you in your palo ? V.

VinceM · ‎09-24-2018

Hi, Nop, not aware of this bug. Just keep in mind that recommanded release (by PA support) are 7.1.18 and 7.1.19. Cheers V.

VinceM · ‎10-05-2017

Hi, Huge amount of new session ... normally, session are sync between cluster member then ... Which model of palo are you using ?? According my experince, path monitoring is not .... always efficient. Maybe when your first palo carshed, failover happen but path monitoring was not up on backup .. then no internet .... Hope help. V.

VinceM · ‎10-05-2017

Hi, With the link you provide, you have all info no ?? Rgds V.

VinceM · ‎09-14-2017

Hi, Just take in consideration taht Panora ma aim is to simplify config deployment between "large" number of PA. In your case, you have only one cluster. between cluster member, confif is replicated automatically. Then, my opinion, if you have only on cluster, integrate them in the Panorama and for management, change of context. In parallele, your panaorma allow you to consolidate all your logs. The best is the ennemy of the good. Rgds V.

VinceM · ‎08-28-2017

Hi, As you know, CPU usage depend of nobre of session but more than that, depend of: - nbre of session open / close per second - packet size - and more .. Mean you can have only few session but if they are very short, with smal packet, is more CPU intensive than huge nombre of session with large packet and long duration in time. If you want to optimize CPU utilisation, 1- check which traffic create this high CPU usage 2- Try to create App overide 3- optimize security profile and logging feature Hope help. V.

VinceM · ‎07-04-2017

Hi all, 100% agree with BPry. this doc is very very old but always up to date and usefull. Just keep in mind. You need to do that on the server side firewall. Mean if you do that on your palo, your partner will be able to access your ressources but you can't access their. If you need to access their server, you need to do the same on your partner side (if supported) Hope help. V.

VinceM · ‎06-06-2017

Correct, internally, just use GP on internal gateway for user authent. No Tunnel, just authen. And if you want to go farther, you can, in futur, use HIP for giving acces to dedicate ressources 🙂 Rgds V.

VinceM · ‎06-06-2017

Hi rjdahav163, In this case, maybe you should have a look on deploying GP on all laptop and use GP on both external and internal gateway with transparent authentication. Switching from wire to wifi auth is really fast. Ref: https://www.paloaltonetworks.com/documentation/60/globalprotect/global_protect_6-0/globalprotect-quick-configs/mixed-internal-and-external-gateway-configuration.html Hope help

VinceM · ‎06-01-2017

Hi, We did some test on PA200 too but no issue with high CPU load. Keep in mind the feature "credential submition" can be intensive for appliances. Need lot of request with special USer agent need to analyse all traffic ... Then at the end, maybe not good idea to use new high load feature on neither PA200 nor PA500 🙂 But V8 on both of them is ok with "standard" featrure. Hope help. V.

VinceM · ‎05-22-2017

Hi, It can be explained because your traffic doesn't match your first rule. On ly diff is your app group ITT, which app are embeded ? On which criteria do you want to allow or block access to these URL ?? AD member ? list of IP ? V.

Member Since	‎08-27-2010 06:32 AM
Date Last Visited	‎08-19-2024 05:09 AM
Posts	443
Total Likes Received	122

Online Status	Offline
Date Last Visited	‎08-19-2024 05:09 AM

About VinceM

Re: DNS not resolving through Prisma Access for a particular domain

Re: Commit Warning for Antispyware

Re: Commit Warning for Antispyware

Re: User-ID Agent - [Error 115]: Cannot open security log for DC..

Re: Dataplane goes restarted

Re: Dataplane goes restarted

Re: infrastructure subnet sizing prisma access ?

Re: Dataplane goes restarted

Re: Panorama via S2S VPN

Re: IP Pool – TTL when IP is allocated?

Re: Commit Warning for Antispyware

Re: Request for Palo Alto PSE Strata Prof. clarification

Re: Panorama via S2S VPN

Re: IPSec VPN only config on VPN Gateway?

Re: Ethernet aggregate group

Re: Global Protect

Re: Global protect client for windows 11

Re: session per second

Re: Two Site to Site VPNs with the same external subnet.

Re: Can i configure duplicate IP's in seperate interaces in seperate VR on a single VSYS or seperate

How Do I Know if Traffic Is Hitting a Decryption Policy?

Re: Need to allow service for Ping application

Re: PA 3050 PAN-OS Upgrade Path

Re: IP pool problem

Re: Probably a strange question...but Linksys RV082 and PA VPN tunnel anyone?

Re: IP pool problem

Re: HA/sync bug in 7.1.16

Re: High availability failover due to high dataplane usage

Re: License/Eula for GlobalProtect Portal client v3.x

Re: Panoram and Clusters

Re: high dataplane cpu at PanOS 7.1.5

Re: Two Site to Site VPNs with the same external subnet.

Re: User ID WiFi and LAN

Re: User ID WiFi and LAN

Re: PA-200 and PANOS Version 8

Re: URL Filter doesn't work in Deny rule

Equinox Beta

Seattle Beta

Unlock your full community experience!

About VinceM