About Gene_Barden

Gene_Barden · ‎10-01-2021

We have GlobalProtect Pre-Logon working with machine certificates however once the user logs into their laptop they are also prompted with thier User Certificate each time. There internal CA does issue machine and user certificates. Is there a way to disallow the User certificate prompt? Do we need to also use User certificates along with machine certficicates? Verion is 10.0.7 and GP 5.2.7

Gene_Barden · ‎08-25-2021

Anyone have any luck with getting GlobalProtect Pre-Logon going wih Prisma Access? Currently testing with an internal CA with bor=th the Root and Intermediate installed in the Mobile User Templete. Client tries to connect and immediately receive an error "Client cert not present". We have tried a self-signed cert and get the same error message.

Gene_Barden · ‎03-09-2021

Thanks! Don't know why I said arp table for layer 2..What would explain the need for HA-2 to require an IP transport with an IP address. I did one with OTV and did not require IP transport. I am not a VXLAN expert but would assume if it is true layer 2 I could use transport ethernet.

Gene_Barden · ‎03-09-2021

Is there a way to determine if HA-3 is actually layer 2 prior to cutover? I assume I can look at the arp tablein the Palo and the switches.

Gene_Barden · ‎03-09-2021

Have an Active/Active deployment, single firewall at each DC with EVPN/VXLAN through Juniper cores. Can we have the HA-3 link go through the core switches? We are using daa plane interfaces for HA-2, HA-2B, and HA-3. We have the vlans stretched across to the other data center for the HA-2 and HA-3 links and jumbo frames enabled. I need to verify if the HA-3 link can operate properly through EVPN/VXLAN or do we need a direct connection. I ask because normally for HA-2 I would just use ethernet as the trasnport but had to use IP even though the vlans are stretched. Also, for session setup I normally use IP Modulo but PAN config guide states First Packet is recommended. Thanks!

Gene_Barden · ‎01-22-2021

Is it best practice to override template variable settings at the template-stack or at the device level? It looks like template stack would be sufficient unless you have multiple firewalls and only a select number with different settings.

Gene_Barden · ‎01-19-2021

The customer is already running BGP internally even though their current ASA is all static routes. I had thought about OSPF but we ended up deciding on BGP internally since that is what they are currently running and upstream to ISRs. The A/A setup is a single firewall at each DC which was originally supposed to be A/P. It's already given me enough heartache so I don't want to introduce any more. 🙂

Gene_Barden · ‎01-18-2021

Thanks, that was my thinking also, why even have the AA cluster at that point.

Gene_Barden · ‎01-18-2021

Have a Active/Active spit data center solution and question has been brought up if it is possible to use different AS numbers on each of the Palo's. My thinking is why have Active/Active, just use each Palo as a separate individual firewall at each DC. I'v never seen Active/Active Palo's having separate BGP AS numbers. It looks like it is possible since the VR config isn't synced but seems it would create an issue. Anyone else ever seen this or have an opinion?

Gene_Barden · ‎09-25-2020

Agreed. The 5050's are 8.1.11 and so is Panorama.

Gene_Barden · ‎09-24-2020

Customer is replacing a 2 pair of 5050's multi-vsys with 2 pair of 5250's. All of the configurations are local to the firewall with the exception of objects which are managed by Panorama. The final plan will be to have Panorama manage the firewalls appropriately. The 5050's will still be in place for a while after migrating to the 5250's. What is the best option to migrate. I've seen different scenarios. Is it best to add the firewalls to Panorama and place in the same device-group as the 5050's and do load-config-partials for the local config or just import the xml file into the 5250's? I also have the device state of the 5050's.

Gene_Barden · ‎08-25-2020

Here is the physical topology of the scenario. All switch connections south of the Palo are trunk ports with all of the vlans trunked. The link between the 2960s has all vlans trunked except for the primary vlan2 which is the main vlan for the network and to the ASA. I have also attached an A/P scenario adding additional switches north of the Palo connected to the ASA also. Trying to decide which scenario will work best. Active/Active Active/Passive

Gene_Barden · ‎08-24-2020

I have a n HA pair of ASA and will be implementing an HA pair of PANS between the Core and ASAs. I can send a topology if necessary. Currently have a Cisco 3750 layer 3 connected to two separate Cisco 2960s via a trunk link. The2960s are aslo inter-connected via a trunk link. The ASAs are connected to each 2960 via access port. The original idea was to implement the Palo Altos in A/P but it seems easier to implement A/A. Are there any gotchas for this scenario. I know it is best practice and recommended for Vwire A/A in a layer 3 topology only and to make sure spanning-tree is configured properly for layer 2. From what I have read you should not carry the Vwire vlan across the inter-switch trunk but wold this just be for the trunk between the 2960's or all of the trunk links? I would think the traffic would not pass if the vlan is not allowed between the 3750 and 2960 trunks.

Gene_Barden · ‎08-05-2020

The php process is at 100%

Gene_Barden · ‎08-05-2020

I am running the latest version v.1.1.76.1. I just upgraded prior to uploading.

Member Since	‎06-06-2018 08:55 AM
Date Last Visited	‎03-22-2022 03:35 PM
Posts	29

Online Status	Offline
Date Last Visited	‎03-22-2022 03:35 PM

About Gene_Barden

GlobalProtect Pre-Logon Prompting for User Certificate

Prisma Access GlobalProtect Pre-Logon

Re: Active Active HA3 Through EVPN/VXLAN

Re: Active Active HA3 Through EVPN/VXLAN

Active Active HA3 Through EVPN/VXLAN

Panorama Template/Template-Stack Variables Override

Re: Active Active BGP AS Number

Re: Active Active BGP AS Number

Active Active BGP AS Number

Re: Replace 5050 with 5250

Re: Expedition Stuck at Phase 9 of 10

GlobalProtect Pre-Logon Prompting for User Certificate

Prisma Access GlobalProtect Pre-Logon

Re: Active Active HA3 Through EVPN/VXLAN

Re: Active Active HA3 Through EVPN/VXLAN

Active Active HA3 Through EVPN/VXLAN

Panorama Template/Template-Stack Variables Override

Re: Active Active BGP AS Number

Re: Active Active BGP AS Number

Active Active BGP AS Number

Re: Replace 5050 with 5250

Replace 5050 with 5250

Re: Vwire Active Active with ASA HA Pair

Vwire Active Active with ASA HA Pair

Re: Expedition Stuck at Phase 9 of 10

Re: Expedition Stuck at Phase 9 of 10

Unlock your full community experience!

About Gene_Barden