About VinceM

Hi,   Nop, have to ho through 7.0.1 first. Look https://www.paloaltonetworks.com/documentation/71/pan-os/newfeaturesguide/upgrade-to-pan-os-7-1/upgrade-a-firewall-to-pan-os-7-1   Rgds   V. ... View more

Hi,   Depend of your PAN deployement. If you want your PAN be part of your routing architecture ... migration, no choice. Else, you can choose to configure your PAN in Vwire then it will be transparent.   Make your choice 🙂   V. ... View more

Hi,   Have you look: https://live.paloaltonetworks.com/t5/API-Articles/Simple-export-of-rules-as-Excel-or-HTML/ta-p/65082   Rgds   V. ... View more

Hi,   Try not to use SHA1 and don't forget proxy ID   V. ... View more

Hi,   We can't have discussion about roadmap on this forum 🙂 But ask the question to your local palo's SE maybe he can have news for you.   V. ... View more

Hi all,   Keep in mind that for using GP on Phone, you ahev to pay for that. If for any reason you can't or just don't want to pay, you can use classic VPN client as Cisco one (Must support X-auth - deployed on all i device by default) and it's free.   V. ... View more

Hi all,   Depend what you are looking for:    - Use Policy Based Routing: Activ/Passiv or Activ/Activ - and you choose which traffic on which link         https://www.paloaltonetworks.com/documentation/70/pan-os/pan-os/policy/create-a-policy-based-forwarding-rule    - Use Link Layer Distribution Protocol  - act like load balancing by defining two route with same weight         https://www.paloaltonetworks.com/documentation/70/pan-os/newfeaturesguide/networking-features/lldp   Hope hep   V.   ... View more

Hi,   I was in the same situation couple of month ago. 1 ISP with two punlic IP subnet. But for me, everything was ok, as soon as you have nat rule define in your palo, it's supposed to work. Are you sure your ISP router send traffic to the palo ? Make a TCP dump on you external interface ? Do you see grat ARP ?   Keep us in touch.   V. ... View more

Hi,   Thx for the template. The fact is f the VPN end on SonicWall, it works, on the palo it doesn't 😞 All protocol needed are allowed (other VPN are ok)   Maybe MD5 ??? I will ask to change from MD5 to sha1 or more ...   Keep you in touch.   V. ... View more

Hi,   Thx in advance for your help. Here the requested log.   =~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2016.08.18 18:48:36 =~=~=~=~=~=~=~=~=~=~=~= tail admin@PADC(active)> tail lines admin@PADC(active)> tail lines 50 admin@PADC(active)> tail lines 50 mp-log admin@PADC(active)> tail lines 50 mp-log ikemgr.log 2016-08-18 18:46:42 [PROTO_ERR]: not matched 2016-08-18 18:46:42 [PROTO_ERR]: no suitable policy found. 2016-08-18 18:46:42 [INTERNAL_ERR]: failed to pre-process packet. 2016-08-18 18:46:52 [PROTO_NOTIFY]: ====> PHASE-2 NEGOTIATION STARTED AS RESPONDER, (QUICK MODE) <==== ====> Initiated SA: 185.42.31.XXX[500]-31.193.53.XX[500] message id:0xEE340F87 <==== 2016-08-18 18:46:52 [PROTO_ERR]: not matched 2016-08-18 18:46:52 [PROTO_ERR]: no suitable policy found. 2016-08-18 18:46:52 [INTERNAL_ERR]: failed to pre-process packet. 2016-08-18 18:47:12 [PROTO_NOTIFY]: ====> PHASE-2 NEGOTIATION STARTED AS RESPONDER, (QUICK MODE) <==== ====> Initiated SA: 185.42.31.XXX[500]-31.193.53.XX[500] message id:0xEE340F87 <==== 2016-08-18 18:47:12 [PROTO_ERR]: not matched 2016-08-18 18:47:12 [PROTO_ERR]: no suitable policy found. 2016-08-18 18:47:12 [INTERNAL_ERR]: failed to pre-process packet. 2016-08-18 18:47:12.795 +0200 ikemgr: panike_daemon phase 1 started, config size 33890 2016-08-18 18:47:12.828 +0200 ikemgr: panike_daemon phase 1 step 2 finished 2016-08-18 18:47:13.114 +0200 ikemgr: panike_daemon phase 1 step 4 finished 2016-08-18 18:47:13.114 +0200 pan IKE cfg phase-1 triggered. 2016-08-18 18:47:13 [INFO]: loading new config from /tmp/.njHLK5 2016-08-18 18:47:15.541 +0200 ikemgr: panike_daemon phase 1 step 5 finished 2016-08-18 18:47:15.541 +0200 ikemgr: panike_daemon phase 1 config change detected 2016-08-18 18:47:15.541 +0200 ikemgr: panike_daemon phase 1 finished with status 1 2016-08-18 18:47:44.823 +0200 ikemgr: panike_daemon phase 2 started 2016-08-18 18:47:44.823 +0200 pan IKE cfg phase-2 triggered. 2016-08-18 18:47:44 [INFO]: IKE gateway EOLAS changed, deleting SA 2016-08-18 18:47:44 [INFO]: ====> PHASE-1 SA DELETED <==== ====> Deleted SA: 185.42.31.XXX[500]-31.193.53.XX[500] cookie:e30ae825f46753b9:9b520bc54bb0cad0 <==== 2016-08-18 18:47:44.826 +0200 ikemgr: panike_daemon phase 2 finished 2016-08-18 18:47:44 [PROTO_ERR]: Informational exchange received from unknown peer. 2016-08-18 18:47:52 [PROTO_NOTIFY]: ====> PHASE-1 NEGOTIATION STARTED AS RESPONDER, MAIN MODE <==== ====> Initiated SA: 185.42.31.XXX[500]-31.193.53.XX[500] cookie:b751989c866b52b4:7a4c9758629b8b91 <==== 2016-08-18 18:47:52 [INFO]: received Vendor ID: CISCO-UNITY 2016-08-18 18:47:52 [INFO]: received Vendor ID: draft-ietf-ipsra-isakmp-xauth-06.txt 2016-08-18 18:47:52 [INFO]: received Vendor ID: DPD 2016-08-18 18:47:52 [PROTO_NOTIFY]: ====> PHASE-1 NEGOTIATION SUCCEEDED AS RESPONDER, MAIN MODE <==== ====> Established SA: 185.42.31.XXX[500]-31.193.53.XX[500] cookie:b751989c866b52b4:7a4c9758629b8b91 lifetime 28800 Sec <==== 2016-08-18 18:47:52 [PROTO_NOTIFY]: ====> PHASE-2 NEGOTIATION STARTED AS RESPONDER, (QUICK MODE) <==== ====> Initiated SA: 185.42.31.XXX[500]-31.193.53.XX[500] message id:0x93765356 <==== 2016-08-18 18:47:52 [PROTO_ERR]: not matched 2016-08-18 18:47:52 [PROTO_ERR]: no suitable policy found. 2016-08-18 18:47:52 [INTERNAL_ERR]: failed to pre-process packet. 2016-08-18 18:48:02 [PROTO_NOTIFY]: ====> PHASE-2 NEGOTIATION STARTED AS RESPONDER, (QUICK MODE) <==== ====> Initiated SA: 185.42.31.XXX[500]-31.193.53.XX[500] message id:0x93765356 <==== 2016-08-18 18:48:02 [PROTO_ERR]: not matched 2016-08-18 18:48:02 [PROTO_ERR]: no suitable policy found. 2016-08-18 18:48:02 [INTERNAL_ERR]: failed to pre-process packet. 2016-08-18 18:48:22 [PROTO_NOTIFY]: ====> PHASE-2 NEGOTIATION STARTED AS RESPONDER, (QUICK MODE) <==== ====> Initiated SA: 185.42.31.XXX[500]-31.193.53.XX[500] message id:0x93765356 <==== 2016-08-18 18:48:22 [PROTO_ERR]: not matched 2016-08-18 18:48:22 [PROTO_ERR]: no suitable policy found. 2016-08-18 18:48:22 [INTERNAL_ERR]: failed to pre-process packet. admin@PADC(active)>   Ipsec is permit.   V. ... View more

Hi,   First, if you want to use Always-on, mean you expect that your GP is up before opening session.... mean certificate authentication 🙂   link: https://www.paloaltonetworks.com/documentation/60/globalprotect/global_protect_6-0/set-up-the-globalprotect-infrastructure/set-up-client-certificate-authentication   or you can setup SSO for GP. Mean transparent authent for GP. Using Windows authentication.   In you prefer to use your RSA token, it mean you prefer the on_demand config.   hope help.   V.     ... View more