About birkhojk

Is Palo Alto's OSPF Graceful Restart checkbox on the virtual router roughly equivalent to Cisco's NSF IETF method?   If I do this on a Palo Alto:     And this on a Cisco... Q:Should it work?     enable configure terminal router ospf  process-id   [ vrf  vpn-name   ] nsf ietf  [ restart-interval  seconds   ] end show ip ospf  [process-id   ]   https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_ospf/configuration/15-s/iro-15-s-book/iro-nsf-ospf.html   Q:  Do I even need to do this if it is showing "IETF NSF helper support enabled"?           ... View more

Can someone walk me through redistribution of OSPF into BGP and BGP into OSPF   I am setting up a new VSYS (already done) with a new Virtual Router to an AT&T AVPN WAN   There is a /30 between us and AT&T, and we use eBGP to AT&T.  On the other router interface, we use OSPF everything in area 0.     Probably no very good reason to clean this up being this is all private IP stuff, but it's a habit.   How do redistribute the OSPF and BGP into one another?   Also, how do I deal with the route-map that sets the community? router ospf 1 redistribute static redistribute bgp 64xxx network 10.x.x.x 0.0.0.0 area 0 (this is a loopback IP) network 192.168.x.x 0.0.0.7 area 0 ! router bgp 64xxx bgp log-neighbor-changes neighbor 10.y.y.y remote-as 13xxx (This is in a /30 with ATT) ! address-family ipv4 network 0.0.0.0 route-map ATT_LTE network 192.168.x.x mask 255.255.255.248 (This is the same subnet as the one above in OSPF) network 192.168.72.0 mask 255.255.252.0 route-map ATT_LTE redistribute connected redistribute static redistribute ospf 1 match internal external 1 external 2 neighbor 10.y.y.y activate neighbor 10.y.y.y send-community neighbor 10.y.y.y soft-reconfiguration inbound (all of these are the same as in the neighbor string) default-information originate exit-address-family ! interface Loopback0 ip address 10.161.191.71 255.255.255.255 end route-map ATT_LTE permit 10 match ip address prefix-list ATT_OUT set community 13xxx:6655 ! ip prefix-list ATT_OUT seq 5 permit 192.168.72.0/22 ip prefix-list ATT_OUT seq 10 permit 0.0.0.0/0     ... View more

What is an easy way to find and replace Palo Alto interfaces?   Let's say for example I am combining a bunch of interfaces such as ethernet1/9 and ethernet 1/10 into an aggregation group (i.e. ae1) and adding these as tagged VLANS i.e. ae1.123, ae1.456   Q: Is there an easy way to migrate over replacing the Interfaces for all the NAT rules, IKE Gateways, Static Routes, etc.? ... View more