This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About aarato
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About aarato
08-29-2023
5Posts
0Likes
0Solutions
Aug 29, 2023Last Visited
User
Activity
User
Profile
Latest posts by aarato
| Subject | Views | Posted |
|---|---|---|
| 21834 | 12-14-2018 10:09 AM | |
| 2084 | 12-13-2018 07:13 PM | |
| 2104 | 12-02-2018 03:45 PM | |
| 2874 | 11-17-2018 08:21 PM | |
| 2881 | 11-17-2018 02:59 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like |
User Badges
Community Statistics
| Member Since | 11-17-2018 01:38 PM |
| Date Last Visited | 08-29-2023 04:17 PM |
| Posts | 5 |
12-14-2018
10:09 AM
I have both PA-3220 HA1-A and HA1-B links connected back to back to each other with a previously verified cable but only HA1 is coming up greeen while HA1 Backup is showing down. The HA1-B interface LEDs on both PA-3220 show green. Any feedback or suggestion is greatly appreciated. Passive HA Setup B HA Setup A Active
... View more
12-13-2018
07:13 PM
Thanks for the reply unfortunately, I couldn't share the live environment, so I labbed it out and it works well in the lab environment. Thanks for the reply though.
... View more
12-02-2018
03:45 PM
My ISP only provides a single ip address for the outside interface via DHCP. I would like to forward port 443 to and internal host, but Palo keeps dropping the packets. It seems as if the device management restriction is responsible for this, but I have removed that policy from the external interface so I am not sure why this is getting filtered. See console message below. Inbound rules are set to ANY and SSH port forwarding inbound works without any problem. Packet drops were inspected with packet filtering so I know the packets are dropped by Palo. Packets (rx,fw,dr) increasing while no tx. admin@PA1(active)> show counter global filter packet-filter yes delta yes Global counters: Elapsed time since last sampling: 45.132 seconds name value rate severity category aspect description -------------------------------------------------------------------------------- pkt_sent_host 6 0 info packet pktproc Packets successfully transmitted to host interface session_allocated 6 0 info session resource Sessions allocated session_installed 6 0 info session resource Sessions installed session_discard 6 0 info session resource Session set to discard by security policy check flow_host_pkt_xmt 27 0 info flow mgmt Packets transmitted to control plane flow_host_service_deny 6 0 drop flow mgmt Device management session denied flow_host_vardata_rate_limit_ok 27 0 info flow mgmt Host vardata not sent: rate limit ok flow_ip_cksm_sw_validation 6 0 info flow pktproc Packets for which IP checksum validation was done in software ha_msg_sent 15 0 info ha system HA: messages sent ha_session_setup_msg_sent 6 0 info ha pktproc HA: session setup messages sent ha_session_update_msg_sent 9 0 info ha pktproc HA: session update messages sent -------------------------------------------------------------------------------- Total counters shown: 11 -------------------------------------------------------------------------------- admin@PA1(active)>
... View more
11-17-2018
08:21 PM
Thanks for the response. The Mac Address is not migrating over when there is a failover. See below. This is in an ESXi environment. Name: ethernet1/1, ID: 16 Link status: Runtime link speed/duplex/state: 10000/full/up Configured link speed/duplex/state: auto/auto/auto MAC address: Port MAC address 00:0c:29:34:b8:61 <<<<<<<<< Before failover Operation mode: layer3 Untagged sub-interface support: no -------------------------------------------------------------------------------- Name: ethernet1/1, ID: 16 Operation mode: layer3 Virtual router DEFVRF Interface MTU 1500 Interface IP address (dynamic): XX.YY.175.22/32 admin@PA1(active)> request high-availability state suspend Successfully changed HA state to suspended admin@PA1(suspended)> admin@PA1(suspended)> show interface ethernet1/1 -------------------------------------------------------------------------------- Name: ethernet1/1, ID: 16 Link status: Runtime link speed/duplex/state: unknown/unknown/down Configured link speed/duplex/state: auto/auto/auto MAC address: Port MAC address 00:0c:29:34:b8:61 Operation mode: layer3 Untagged sub-interface support: no -------------------------------------------------------------------------------- Name: ethernet1/1, ID: 16 Operation mode: layer3 Virtual router DEFVRF Interface MTU 1500 Interface IP address (dynamic): XX.YY.175.22/32 <<<<<<<<< After failover Interface management profile: PING ping: yes telnet: no ssh: no http: no https: no snmp: no response-pages: no userid-service: no Service configured: Zone: Untrust, virtual system: vsys1 Adjust TCP MSS: no Policing: no admin@PA1(suspended)> request high-availability state functional Successfully changed HA state to functional admin@PA1(initial)> Here is the other vm which become ative with its own vmware MAC admin@PA-VM(active)> show interface ethernet1/1 -------------------------------------------------------------------------------- Name: ethernet1/1, ID: 16 Link status: Runtime link speed/duplex/state: unknown/unknown/down Configured link speed/duplex/state: auto/auto/auto MAC address: Port MAC address 00:50:56:92:19:11 <<<<<<< OTHER SIDE MAC Operation mode: layer3 Untagged sub-interface support: no -------------------------------------------------------------------------------- Name: ethernet1/1, ID: 16 Operation mode: layer3 Virtual router DEFVRF Interface MTU 1500 Interface IP address (dynamic): XX.YY.175.22/32 <<<<<<< OTHER side Has the same IP Interface management profile: PING ping: yes telnet: no ssh: no http: no https: no snmp: no response-pages: no userid-service: no Service configured: Zone: Untrust, virtual system: vsys1 Adjust TCP MSS: no Policing: no admin@PA-VM(active)>
... View more
11-17-2018
02:59 PM
I have a pair of VM-50 as an HA pair. When the primary firewall fails the IP is moved to the new active node but the MAC address changes and the ISP cable modem most likely does not accept this. The only resolution is to release and renew the DHCP address which is obvisouly not a workable solution for an automatic failover. Any ideas?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-29-2023
04:17 PM
|
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks