About nson2139

nson2139 · ‎11-29-2018

Folks, We configured a devices some fays back and it is now up and running. Our plan is to add this to the Panorama and replicate the same policies which will act as a template for other devices. What care needs to be taken so that the Panorama would not affect the existing configuration? (if that could happen). Eventually, all device will be managed by the Panorama. Regards,!!!

nson2139 · ‎11-29-2018

bingo!!! this did the trick.

nson2139 · ‎11-29-2018

Folks, Typically when we build a IPSec tunnel from the AWS VPC to the on-prem Palo Alto box we get an option of 2 tunnel's from the AWS. I have options of configuring both the tunnels as UP/UP when the end point is something like a Juniper ISG-1000/ISG-2000 device. However, when I configured it on the PA-3260 only one of the tunnels is seen as up and the other is seen as down and this happens because the PA does not take equal routes to the destination on both tunnels.(at least that is what I seen). I wanted to check if it is something I did incorrect. Any suggestions/guideance? Thanks!!

nson2139 · ‎10-26-2018

ok, understood. However, do you see a potential issue that could occur in the ealier design? The firewall should still be able to keep session information if the packet comes inside over one path and goes out via the other, right?

nson2139 · ‎10-25-2018

yes, I agree. But in my case the switches are on a single interface. There is no point using the aggregate interfaces. 🙂 aggregate interface would be needed if they are also connected to the same switch ...right?

nson2139 · ‎10-25-2018

thanks for the comments mate!! Yes, it has to be virtual wire becuase we do not want to disturb anything in the existing setup. There is already routing protocols running between the switches and we want to retain that. The firewall should maintain the state table from one zone to the other, right? if yes, this should work without any challenges from what I think.

nson2139 · ‎10-25-2018

It gave me a warning saying "High-availability with ha2 configured should also be configured with state synchronization enabled(Module: ha_agent)" but immediately came up in the passive state." 🙂 This looks good, should the warning cause any challenges?

nson2139 · ‎10-25-2018

Folks, we have a switch to switch routing protocol running and the requirement is to put a palo alto in a vwire mode on such an environent. Please see the file attached with tis post. Now, the catch to this is the "switch-out" forms neighbours with "switch-01" and "switch-02" and packets going inside one link could come out of the other. I just wanted to ensure that this will not cause any packets drops as long as the zones are correctly configured. also, from a very high level what configuration would be needed? Convert each interface to a vwire? add the zones? add the policies? anything else? Thanks!!!

nson2139 · ‎10-25-2018

upgrading to 8.1.4 reduced the state changing time but it still takes around 1 hr.

nson2139 · ‎10-25-2018

upgrading to 8.1.4 reduced the state changing time but it still takes around 1 hr.

nson2139 · ‎10-25-2018

by very long I mean more than 4 hours.... I am not sure if that is normal. to configure the data link I do not have the hardware and this is not a requirement at this moment.

nson2139 · ‎10-23-2018

Folks, Our Active-Passive pair takes too long to show the status(i.e. active or passive) when one of the firewall is rebooted. i.e. as of now things are running fine, but if I reboot the passive firewall it will take a very long time to once again come up as passive. It goes through the "not ready" and "initial" stages before getting in the "passive" stage. These are PA-3260 boxes and I have used the ha1-a as the control link and the ha1-b port as the backup for control link. Only the control link has been used for this HA configuration. Please let me know if there are any suggestions on this and how could I work on overcoming the long time duration? Thanks!!!

nson2139 · ‎09-13-2018

Folks, some what confused on how to start with this. I went through all the documentation which talks about an IAM policiy and definining roles ubt am not able to get where to configure this. My requirement is to have a firewall with an untrust/trust interface and a management interface. I believe I will need an additional HA interfaces as well. The below link mentions about the policiy: https://www.paloaltonetworks.com/documentation/80/virtualization/virtualization/set-up-the-vm-series-firewall-on-aws/high-availability-for-vm-series-firewall-on-aws/iam-roles-for-ha Do I write the policy manually? And then attach this when I create the instances? Thanks!! N.

nson2139 · ‎08-13-2018

Team, We have a NAT pool configured for one of the ongoing requirements. Is there a way to force this pool to allocate IP address from start to end as per new requests come in? e.g. NAT pool configured is 10.10.10.1 to 10.10.10.10 IP source is anything between 192.168.10.1 to 192.168.10.10 We noticed that if the traffic source is 192.168.10.2 it could take an IP from anywhere in the NAT pool. I want to force it to take a first IP in the pool. Also is it possible to configure something which keeps the last octet static? (this may be too much to ask.) Thanks!!! N.

nson2139 · ‎07-12-2018

We are looking at some method where we can dynamically NAT subnets behind the Palo Alto Firewall to pick an IP address from the network defined on the external interface. e.g. I have the external IP address network defined as 10.100.100.0 /24. The IP address 10.100.100.20 is defined as the IP of the external interface. In the internal network we have about a few networks defined i.e. 10.10.10.0/24, 10.10.20.0/24, 10.10.30.0/24. We are looking at some configuration where we can do some dynamic NATting for these internal networks to pick up some IP address from the External network defined. Thanks!! N.

Member Since	‎01-22-2018 11:44 PM
Date Last Visited	‎09-04-2021 12:14 AM
Posts	44
Total Likes Received	1

Online Status	Offline
Date Last Visited	‎09-04-2021 12:14 AM

About nson2139

Traffic issue on the Palo Alto(zone-to-zone)

Re: eBGP between remote Palo Alto devices.

eBGP between remote Palo Alto devices.

Palo Alto BGP with AWS Transit Gateway.

Using the Panaroma as a central manager for Cisco AnyConnect.

Re: accessing a new Palo Alto firewall in the AWS.

Palo Alto OSPF routing./wild card mask configuration.

policy based forwarding issue on palo alto.

Source NAT on a IPSec VPN tunnel due to overlapping IP space.

Statistics for data transfer on a Palo Alto.

Re: Tunnels status VPN between Palo Alto-3260 and AWS VPC.

Re: Tunnels status VPN between Palo Alto-3260 and AWS VPC.

Re: HA configuration in the AWS

tips for adding devices to the Panorama.

Re: Tunnels status VPN between Palo Alto-3260 and AWS VPC.

Tunnels status VPN between Palo Alto-3260 and AWS VPC.

Re: recommendation when putting the Palo Alto in a vwire mode.

Re: recommendation when putting the Palo Alto in a vwire mode.

Re: recommendation when putting the Palo Alto in a vwire mode.

Re: Active-Passive pair takes long to show the status when one is rebooted.

recommendation when putting the Palo Alto in a vwire mode.

Re: Active-Passive pair takes long to show the status when one is rebooted.

Re: Active-Passive pair takes long to show the status when one is rebooted.

Re: Active-Passive pair takes long to show the status when one is rebooted.

Active-Passive pair takes long to show the status when one is rebooted.

HA configuration in the AWS

NAT allocation during a pool configuration.

Dynamic 1:1 NAT on the Palo Alto interface.

Unlock your full community experience!

About nson2139