About x

I'm wondering if anyone has a similar setup and got it working. I'd like to have both SMTP services enabled on two ISPs for load-balancing and redundancy. I tried using PBF but couldn't get it working. It seems SMTP for ISP1 works fine but SMTP for ISP2 comes into the firewall but the application is incomplete. Which tells me the 3 way handshake is not completing. I took a pcap and didn't see any drops however.  I followed the articles below as guidelines:   https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Symmetric-Return/ta-p/59374   eth1/1.2 ISP1 1.1.1.1 eth 1/1.3 ISP2 2.2.2.2 Inside 10.1.1.1 - STMP server is 10.1.1.25   Security allows SMTP traffic to both ISPs NATs for both ISPs (inbound and outbound on SMTP service) Default route is 2.2.2.2 PBF to force symmetric return if interface comes in from from eth1/1.3  PBF forces browsing to 1.1.1.1   From what I can tell all the policies that I've defined are being hit and symmetric return is being acknowledged but the traffic is not going through. Traffic for ISP1 is identified as SMTP but for ISP2, it is incomplete.   I've got a TAC opened but also wanted to check with our awesome community!    Thanks folks!     ... View more

Hello folks,   Maybe someone has seen this before. I've got my syslog profile, log forwarding and policy setup the way they should be configured but the only exception is that I'm using a data port and UDP 1514. I've configured a service route and also allowed the syslog server on my interface management profile. The connection between the firewall and the syslog is via a VPN tunnel. I can ping both ways and see traffic for syslog on both firewalls for both IP addresses (syslog and firewall) and there the logs are not getting to my syslog server. The logs are forwarded to Panorama and also using templates so I know the log forwarding profile works. It works for other firewalls. Not sure what I'm missing. Is there log file I can check outside of traffic logs?   Thanks ... View more

I just deployed a PAN-VM and everything is working except I don't have any traffic logs for some reason but I do have ACC, System and Conguration logs. The only thing I can think that may cause issues is the fact that the box is not licensed yet as I'm just testing it out. Is this why? An unregistered PA-200 logs traffic data though so I find this really odd. Anyone can confirm if this is due to license or is it due to the PAN-VM configuration? I used thin provisioning for the disk. I can try redeploying with thick provisioning but wanted to ask here first. Thanks so much! ... View more

We have reports of certain users not being able to access our public website but majority of users are able to. The traffic log shows that the application is incomplete. Packet capture reveals the 3-way handshake does not complete and the session times out. The same person who is NOT able to access the public website is able to access another website of ours that is hosted on another IP address but on the same firewall. The difference between the two sites are as follows: Different external IPs but same subnet Different internal Zones (1 server is on DMZ; not working and 1 server is on the Trust zone; working) Different gateways, different switches The DMZ's gateway is the firewall while the server on the trust side's gateway is a core switch Has anyone seen something like this before? Again, it works for 99% of the users but there are a number of users that are not able to get to the website for some reason. We initially thought it could be a routing issue with the ISP that we use since majority of the users who reported the issue belongs to the same ISP that we use. HOWEVER, we did find a user who uses the same ISP and IS ABLE to browse. NAT is a regular destination NAT Untrust to Untrust Src IP: Any Dst IP: Public IP of server Destination translation IP: DMZ IP of the server Policy is a regular allow inbound policy allow access to website Zone: Untrust to DMZ Src IP: Any Dst IP: External IP of DMZ server Some other info that might help. There are two ISPs but only one is used and the other is a backup in case the other one is down. I'm using PBF to achieve this as per the PBF doc/KB. There is a zone protection profile and enabled all of them. I removed it temporarily but it didn't help. I tried to do a static bi-directional NAT as a test but it didn't seem to help Any help would be appreciated! ... View more

Hi Guys, Does anyone have any optimization tips that they've done for GlobalProtect? Looking for ways to speed up auth in the event the client gets disconnected when the device switches from wifi to cellular network. What we are seeing is it disconnects but doesn't connect or it takes awhile before it reconnects. using it on iOS. Thanks, ... View more