About pulukas

Are you certain that both directions of the flow cross the A/A firewall pair?   Based on your description, there should be no asymmetrical flow drops on the firewall.  Unless there is a path that can bypass BOTH firewalls in the commuications flow in question. ... View more

Link monitoring and path monitoring are about watching the connection status between the PA and the connected device.  This is not about monitoring the status of the HA pair. This does not matter what the connected device is.   So when you configure link monitoring you are watching for the link status between the PA and the other device going link down.     Path monitoring is using the selected link to run the ping test and can detect failures upstream of the actual link failure.  The link can be link up but not able to reach the internet for example because of failures beyond the link itself.  But this is testing the path to the rest of the network or upstream and not the HA status of the two devices.   ... View more

With A/A you can have assymetrical flows.  But they do need to maintain the zone relationship that match the session for the flow.  So make sure the policy that permits the traffic has the zone to zone setup needed for the communication across the two devices.   Easiest way to troubleshoot this kind of flow is to do the trace route from both devices and then map the interfaces hit by the packets in the flow on the two PA devices.  Then lookup the zone assignments and confirm the policy is in place in the correct direction by initiator of the traffic. ... View more

Is there an ip address in that subnet configured on the sub interface? This should create a direct route automatically.   I am assuming the PA is layer 3 for this setup is that right? ... View more

You can search the Palo Alto threat vault online for more information on specific vulnerabilities.   https://threatvault.paloaltonetworks.com/ ... View more

For this transition you will need to monitor and know the actual traffic patterns among the A/A interfaces in the zones.  In A/A all interfaces pass traffic and that traffic can be asymmetrical.  So there are two possible problem areas in the conversion.   Passive device interfaces down   If you have connections that go through what will be the passive firewall these connections will be lost when it goes from active to passive.  The ports are link up but no traffic passes.  So when this happens you need to be sure network devices that go through the now passive firewall will see the active firewall path as available.   Asymmetrical traffic   Similarly, traffic that comes in from various zone interfaces will now only see one instead of two options.  They all must be able to find the alternative path over to the active firewall where they formally used the passive.   Most of these issues will come up only if you have the A/A firewalls directly connected to other routers as an only path link.  If the A/A firewalls connect to a switching matrix and share the VLAN in the respective zones, you likely won't have any issues.   If you post a diagram of your site we can help you be sure. ... View more

From what you describe here it does sound like a possbile bug.   And I would continue with the troubleshooting method you have started.  Adding back in one category at at time and finding the one that triggers the block.  This should then give you both a work around and all the information support will need to find the final fix. ... View more

The official list of SFP that PA sells and supports is here.   https://live.paloaltonetworks.com/t5/Operations-Documentation/810-000077-00N-Reference-PAN-HW-Accessory-Cross-Ref-amp-RoHS/ta-p/63422   But I have used 3rd party optics successfully in the past.  The safest course in this regard would be to use Finisar which is the PA supplier as well. ... View more

Your other option is to hop on a switch or router in the same subnet as the mgmt ip address and do the ssh from this device.   Then the communication is all over the local vlan and the missing default route will not matter. ... View more

TACACS+ is basically a Cisco solution.  The vast majority of the deploys and usage is done by Cisco using enterprises.     The reason other vendors like Juniper and Palo Alto Networks support using TACACS+ for authentication is that a large number of companies have TACACS+ deployed as their primary AAA solution.  Nework vendors don't want to lose out on an RFC for equipment just because they don't support a AAA solution that is in place on the network.  By the nature of this type of solution enterprises only want to deploy one central AAA repository. ... View more

Just to clarify,  the reason asymmetrical routing is bad is because the PA is doing deep packet inspection for the entire flow.  In order to fully protect for threats the PA needs to see all of the packets.  When you have asymmetrical routing the each side is only seeing some of the packets and neither has the full picture to evaluate and block the threats. ... View more

Ideally, I would create a connection between the peering routers at the two DC upstream of the PA clusters.   Have the PA cluster at each DC assume primary routing for particular subnets or even specific addresses that are published to the internet.  Advertise these specific routes up to the peering routers.   Now both peering routers have specific internal routes for the services published to the internet and that will be the path taken no matter which ISP or DC the traffic arrives on.   Not the assymetry issue will only arise during a failover situation where the prefix or address has to move from DC to DC.  And the need to re-establish the session will be far less disruptive and only need to happen at the time of failover. ... View more