About Alex_Samad

Hi   No my hope was to only allow say port 443.   If I have a long lived websocket connection so only 443. I would hope to allow non syn tcp packets only if they are destined for a specific IP and only specific port.   Alex ... View more

Hi   Thanks, for the link.   So tell me how would you deal with this scenario.  2 DC at each DC I have a HA Cluster.  The HA Clusters are first hops onto the internet say 2 transit providers at each site.  You publish your Prefix out.   You have long lived TCP streams to addresses inside so    inside server (with public ip address) -> core network -> PA HA cluster -> ISP -> internet -> Client fw -> client server   just say there is an issue with one of the providers, so the stream that was coming from one internet provider and over the HA pair at DC A is now coming over the internet on HA pair at DC B.   I don't see any reson why the TCP session should be dropped and re created   Alex   ... View more

Hi   solved my problem. Seems like even though the ip is shared between active active nodes. the actual ip isn't for routing. I believe what tech support advised was they don't want both nodes replying to pings.   This caused a problem with OSPF, it was registering with one node and not the other and the other node would add the route but by a different interface. once it was registered on a different interface it stopped repling to arp's !   So now I have a OSPF exclude for all VIP addresses, that was interesting... Makes me thing should the VIP addresses be /32 or /24 (the same as the network, I am used to using /32 aka vrrp... )   I think i have enough capacity between DC. and I will be using the 10G (LACP connects).   I will probably go back to failover once I have completed my test as currently teh DGW for each network is not really needed between DC's.   A ... View more

For the record, its just me.   I had to set the service ports as well.   All working well now ... View more

Hi   Thanks for the input, from every one.   Currently I am in a testing/POC phase. Our standard is to make services/INF available at both DC at the same time.  My arista switches can do this, but their L3 FW is really non existant.   So PA have said they can do Active / Active this is what I am testing and hopefully what I am going to implement.     If it hard thats okay, work out the issues and document it If its complicated thats okay, work out the issues and document it   If it doesn't work, well then i have an issue, this is a feate of the PA's if it doesn't work, I want to know why have i hit a corner case. How  does support handle this. I have opened a support case.  The sup engineer said it should work, infact when we pushed it over to ip hash it all started to work, push it back to modulo and clear the arp cache on the VM and it stop working again ...   My guess is when i finalise my testing and design, I will have active/active and a mixture of pinned and arp load sharing VIPS. ... View more

Actually even worse than this ....   the standard ports of the other applicaitons are allowed to the proxy   so for example msn-file-transfer allows 1025-65535 ... so now all these ports are allowed to the proxy !!! ... View more

Hi   Okay, I can accept Active/Active is complicated.  What I can't accept it that it just broken. if it work for big environments then it should work for all environments.   Because this is a trial, I want to investigate what the issue is.   I have done packet captures on both pa's and I can see the arp request is being dropped by both PA's ???  thats very strange   If this is a common issue, then maybe the PA's are not for me. this seems like a fairly standard easy setup. My Aristra switches can do vrrp across 2 nodes for a distributed DGW.    When I disable one pa1 from the active active setup it all works fine.. ... View more

I can see a zone per vlan / network,  but thats a lot of zones.   Where can I find the limitation on say a pa-3060 for the number of zones ?   plus question.  if I have 5 zones z1 , z2 ... z5 and then are connected in serial one after another    z1 -> z2 -> ... ->z5   if I have a packet that is coming from z5 going to zone 1 and I have a rule that says allow z1 to talk to z5  will the PA allow it through even though the next hop is z2 ?   A ... View more

Added a static route and added in redistribution of static into ospf     ... View more