About mrajdev

mrajdev · ‎10-31-2019

Also check the VPN flow on both sides when you do a ping to check the encap/decap counters. This will help you find out which peer to focus on. Also setup a packet-filter and use the command "show counter global filter packet-filter yes delta yes" do this command multiple times and look for drops. Hope the above helps. Thanks

mrajdev · ‎08-05-2014

Can you also please check if you have any implicit deny rule configured at the bottom of the rule base on the PA. This at times may cause some unintended issues for traffic terminating on the device.

mrajdev · ‎02-08-2012

If the route on the advertising PAN is learned via IGP and you want to advertise the IGP route to EBGP, in this case you will have to use the redistribution rule. Please choose the route you would like to advertise in the redistribution rule and set the values you would like to have for that redistributed route. Hope this helps. Thanks

mrajdev · ‎02-03-2012

Hi Rod, As far as I know there is no option to set up a client proxy server for the PC Client using GP. If you need this functionality I would suggest you to get in touch with your sales team. Thanks

mrajdev · ‎02-03-2012

There is a fix for the download process showing pending status for a long time in 4.1.2 and 4.0.8.With the fix the previous workaround is not needed. Thank

mrajdev · ‎02-03-2012

Hi, The route which you want in the RIB-out is it existing in the route table? The route which you want to advertise out via BGP needs to have been learned either via a IGP routing protocol or a IBGP update from your own AS. Hope this helps. Thanks

mrajdev · ‎12-02-2011

The Host IP addresses you are trying to ping and RDP for, do these host know to reach the remote netconnect client IP address they need to be routed through the palo alto device? Also based on the zone the tunnel interface is connected to, do you have a policy to allow ping and rdp.If the policy allows the app, please ensure it is ping and not ICMP. Hope this helps. Thanks

mrajdev · ‎12-02-2011

Hi Jan, If there is a problem with the connection to the PAN agent and the user id info based on which the policy is enforced is not available then the policy used to allow the user will not work. If you happen to see this issue again then please call into support so that we can troubleshoot the issue and determine the cause of the PAN agent connectivity to the FW. Typically we would first go and check on the PAN-agent if the user id info is there and then check on the FW for the user id info as well. Based on the outputs we will have to do additional troubleshooting steps to determine where the problem lies. Thanks

mrajdev · ‎11-29-2011

Hi, At this time we do not have a option to set the P-bit for routes getting redistributed into NSSA OSPF area. I would suggest to please contact your sales team to request for them to put in a feature request. Thanks

mrajdev · ‎11-28-2011

Hi, We have one issue related to NAT-T which will be fixed in 4.1.1. For your issue I would suggest you to open up a support case so that we can review the log/debug information to determine if the issue you are seeing is the one which is going to be fixed or if this issue is a different one. Thanks

mrajdev · ‎11-22-2011

Not sure if I understood your question very well but If you use PBF then if you add static routes for those lans then those will not be used. Please let us know how the link change went and if the above is what you observed? Thanks

mrajdev · ‎11-22-2011

As far as I know chaining of url via google translate will not block for both url and app-id. I would suggest to contact your system engineer to check on this and put in a feature request if it is not currently supported. Thanks

mrajdev · ‎11-22-2011

One more thing I wanted to add there was support added for this in content version 272. Incase if you are not using content 272 or above then please upgrade the content. Thanks

mrajdev · ‎11-22-2011

Ben, Can you please try the following 1) Can you also please check the threat logs or data filtering logs to see if you see any drops. 2) If you don't see any then please try to setup a policy for the android without any profiles. If #2 works then please open up a support case and let us know the link for the app and the content version and software version you are running. Hope this helps. Thanks

mrajdev · ‎11-15-2011

Mcue, This issue is targeted to be fixed in 4.1.1. Thanks

mrajdev · ‎10-14-2011

Jeff, TCP sequence number checking is enabled by default.You can turn it off if you wish using the command above. Thanks

mrajdev · ‎09-26-2011

Ron, You have to make sure the Layer 2 path and then Layer 3 reach ability is there between the L3 interface on PAN and the next-hop router. Depending on how many times the packet originating from the PAN L3 interface will traverse the PAN through the L2/Vwire interfaces, you need to ensure there is a policy between the two zones (ingress and egress zone) is present. Hope this helps. Thanks

mrajdev · ‎09-24-2011

Roh, Based on the image you have uploaded seems like the license is getting expired in Oct and you are getting the license expire log messages one month before the expire. Can you please confirm that license on this device is valid till Oct? Thanks

mrajdev · ‎09-24-2011

Check to see if you have a multi-hop option on the PAN, If you do change the multie-hop to 2 on both sides, Then you should be able to do BGP to loopback. Hope this helps.

mrajdev · ‎09-22-2011

Ron, I think you will be fine based on the info you provided.

mrajdev · ‎09-22-2011

You are correct. The IP address on the L3 inteface needs to be different subnet from the mgmt interface. You should not have an impact on the firewall functionality unless you have a lot of VPN traffic and VPN tunnels. The 2050 will be able to do both Vwire and VPN termination, assuming you are not already at the max limit of the 2050 packet handling.

mrajdev · ‎09-22-2011

Hi, To answer your question you can have a mix of Vwire and L3 interfaces on the PAN. So you can add a few sub-interface on one of the ports and configure L3 for those sub-interfaces and terminated the VPN on one of the sub-interface. You need to make sure there is reachability from the L3 sub-interface to the remote end VPN peer IP address. Hope this helps. Manish

mrajdev · ‎09-22-2011

Sunil/Alex, I would request you to please contact your sales team from Paloalto networks to put in a feature request for your scenario. Thanks

mrajdev · ‎09-22-2011

Not sure what you mean when you say QoS Max hit. Can you give a quick example of your QoS profile so that we can provide you with an accurate answer. Thanks

mrajdev · ‎09-21-2011

1) The commit times of 4 to 5 mins is ok. There is no hardware issue, if the config is small and there is no change then the PA-500 might get the commit done in 30 seconds. 2) When you downgrade to 3.1.10. If you had certs in 4.0 then the cert from the config is no longer there, that is one of the reason why the auto commit will fail after the downgrade. Auto commit will keep trying to commit successfully and will try it for 6 times before it fails. You can do a show jobs all and show job id <job id> number to find the reason of the auto commit failure. Load the ssl-cert if you had this in the config on 4.0 and fix any another other reason for the commit failure. After this the device should work fine. If you need help then please call PAN support. 3) You should open up a support case to check on the crash issue. 4) There is no SSD on PA-500.SSD are only on the PA-50X0 series device. Hope the above helps. Thanks

mrajdev · ‎09-20-2011

One more thing I wanted to confirm was are you using two ports to connect the two VR on the same device? If not then you will have to use two ports to connect the VR externally or this will not work. The two VR will need a physical interface to send out the packets.Do please let us know if this helps resolve the issue.

mrajdev · ‎09-20-2011

Just wanted to confirm, so you are doing BGP between two IP addresses in which each BGP peer resides on a difference VR, each VR is in difference Vsys on the same device, correct? For checking the session are you inside the vsys to check the session? If you are in the vsys, have you checked by going into both the vsys to check the session? I would suggest to use the CLI to check the session. Please let us know on the above. Thanks

mrajdev · ‎09-20-2011

Hi Andrey, Can you please open up explorer, navigate to the directory where the PAN-agent software has been installed. Once you are there, can you please select the .exe file, right click on it and run as administrator. This should resolve the issue you are seeing. Please let us know if this works for you. Thanks Manish

mrajdev · ‎09-13-2011

Aj, Seems like you management server is using a lot of memory. You can restart the management server using the command "debug software restart management-server". Also would suggest you to upgrade to the latest release of software so that the issue does not reoccur. Hope this helps. Thanks

mrajdev · ‎09-13-2011

TU, You cannot use a subnet /24 to translate to one static IP. You will have to use a /32 address to translate to one static IP. That is why you are seeing that error. Hope this helps. Thanks

Date Registered	‎02-25-2011 04:42 PM
Date Last Visited	Thursday
Total Messages Posted	94
Total Likes Received	19

Online Status	Offline
Date Last Visited	Thursday

Strata

Prisma

Cortex

About mrajdev