Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About khsieh
About khsieh
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
4 weeks ago
15Posts
1Like
1Solution
May 06, 2020Last Visited
User
Activity
User
Profile
Latest posts by khsieh
| Subject | Views | Posted |
|---|---|---|
| 2515 | 07-10-2019 01:54 PM | |
| 1042 | 07-10-2019 01:51 PM | |
| 2588 | 07-08-2019 12:43 PM | |
| 2987 | 04-04-2019 04:21 PM | |
| 2992 | 04-04-2019 03:25 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 | 03-04-2019 10:36 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 2 | |||
| 1 | |||
| 1 | |||
| 5 | |||
| 1 |
User Badges
Public Statistics
| Date Registered | 12-11-2018 07:55 PM |
| Date Last Visited | 4 weeks ago |
| Total Messages Posted | 16 |
| Total Likes Received | 1 |
07-10-2019
01:54 PM
I would NOT install 8.1. There are many bugs in 8.1 that don't get resolved until later versions. I have seen bugs listed that specifically say that it can cause problems on upgrade. I would download 8.1, but then download and install 8.1.8-h5, which is the current recommended version.
... View more
07-10-2019
01:51 PM
I have a deny all and log as the last rule post rule in Panorama. It applies to all firewalls, so the default inter-zone and intra-zone rules never get hit. More logs is the double-edged sword. If I don't want to see something, I have been known to put in a rule to block traffic and not forward it to Panorama.
... View more
07-08-2019
12:43 PM
I made the jump without issue. Just be sure to have 8.1.0 downloaded as well.
... View more
04-04-2019
04:21 PM
Yeah, I may have to just run eBGP between my firewall and switch. Actually, setting up eBGP is the first step in my fix.
... View more
04-04-2019
03:25 PM
@nextgenhappiness wrote: You could change the Administrative Distances on the firewall virtual routerr. Network -> Virtual Router -> Router Setting -> Administrative distances. Yeah, but that would be a global change, instead of allowing me to be more selective, and I would end up with other routes not being what I want, so that isn't really a solution.
... View more
03-28-2019
03:15 PM
Learning the two routes via BGP is working just as you would expect it to. I can control the chosen route via my BGP import rules.
... View more
03-20-2019
04:33 PM
I thought you could go from 7.1.x directly to the latest 8.0.16, and then directly to 8.1.7. You need to download the 8.0 and 8.1 base, but they can be deployed with the latest 0.0.x update.
... View more
03-18-2019
05:53 PM
Yes, I am pretty bummed that my 5050 are not supported, but my 3020 are.
... View more
03-18-2019
05:35 PM
I have not had this issue, but maybe because my changes have been independent from the other person's changes. It sounds like your changes depend on something else being added by another person. BTW, are you using Panorama? If you are, I really like the improvements in Panorama 8.1
... View more
03-18-2019
12:22 PM
I am looking at having the router with the OSPF path to also advertise the routes back to PAN via BGP. I can then filter on the PAN which of those BGP routes I want to accept, and to give them a lower metric (higher priority).
... View more
03-18-2019
12:20 PM
I believe MED only influences the difference between two different BGP paths for the same route.
... View more
03-11-2019
04:21 PM
I have an interesting problem that I haven't found a satisfying solution for. I have various remote sites connected via private circuit with OSPF, and then IPSec VPN with eBGP learned routes. The administrative distance of eBGP is 20, and the administrative distance of OSPF is 30. I believe these are the defaults. Right now, if there are two paths to a site, my firewall will always chose the eBGP route. I have sites where I want the eBGP route to be the backup to the OSPF. I haven't been able to get that to work. Is there anything I can do in OSPF or BGP to make a route learned by that protocol more or less desirable than a path learned by the other protocol? I have been able to get this to "sort of" work by using static routing with path monitoring to "force" the OSPF path to be taken when it is available. This works, but takes significantly more configuration than what I would like, and is essentially replacing OSPF with static routing in that case. Anyone have any better ideas? I am thinking of building my IPSec tunnel to a different VR, and then the route can be shared between the new VR and the default VR via OSPF. I can then have a higher OSPF cost between the VR. Thoughts?
... View more
03-11-2019
03:54 PM
My rule of thumb is that I don't make any changes to my firewalls outside of Panorama. I have never had Panorama down outside of Panorama upgrades, so it hasn't been an issue. If I did make changes locally, I would just manually recreate on Panorama. Since you only have 1 cluster, it seems unlikely that Panorama would be down and you needed to make many changes locally. I have found that the import process back into Panorama can be a challenge, especially if there is existing configuration. I believe that duplicate items can get created.
... View more
03-04-2019
10:36 AM
1 Kudo
Panorama 8.1 has been out for a long time now, and template variables work with 8.0.x firewalls! If you haven't upgraded to Panorama 8.1, do it if you don't have 7.1.x firewalls or earlier. I am really liking the changes in Panorama 8.1. None of my firewalls are at 8.1 yet, but there is now a stable and recommended 8.1.x release.
... View more
12-11-2018
10:05 PM
Bi-directional NAT would be simpler. Your HELO should match DNS in both directions, in additional be listed in your SPF record. It is also possible that your IP is blacklisted.
... View more
Latest Blogs
Latest Posts
Copyright 2007 - 2020 - Palo Alto Networks
