LIVEcommunity - About Cdchamberlin

Cdchamberlin · ‎03-10-2020

Hi @DewhirstR , Hope all is well and you get this worked out. Take a look at page 13-15 and verify the VPC attachments for both spokes to the TGW. Verify Associations in the TGW Route Table for the VPCs.

Cdchamberlin · ‎08-18-2019

I apologize for asking stupid questions. . Looking at the templates, there are many and it appears most - if not all would work. I guess I'm looking for direct guidance on the approach to take. The two firewalls I have are being load balanced under an NLB. One firewall is in AZA and another in AZB. I can export the xml configuration.. With that, what template should I dig into that you suggest? I just want an ASG in each AZ. Thanks again.

Cdchamberlin · ‎08-17-2019

For my EC2 instances (App Server), I just created Launch Template/ASG. Can I do the same thing with the VM-Series FWs? Capture an AMI, create a Launch Template and ASG? Here is my situation, I have two firewalls that I manually built under an NLB. I would like to replace those with an ASG. Any advice would be super appreciated. Thank you,

Cdchamberlin · ‎08-02-2019

Working on a POC. Have two firewalls sitting under an NLB. One of the firewalls routes traffic to database. This appears to be a limitation on the VPC route tables. With traffic from App server destined for the DB, it goes through AZA palo alto. What advice do you have if this firewall dies? Anyone else experience the limitation with having to route to a specific ENI?

Cdchamberlin · ‎07-31-2019

Up top, have an eBGP peering with ISP. Trusted Zone > L2 Links down to Nexus > then Juniper ToR switches aggregating servers The firewall will perform L3 and contain the VLANs. How would you go about the connections from Palo > Nexus > Juniper

Cdchamberlin · ‎07-31-2019

two firewalls behind an NLB. what approach would you take to spin up additional firewalls if a certain threshold is hit (what threshold would you trigger on)? i've looked at the templates provided by palo alto but this would be adding additional firewalls in already established VPCs. also use panorama

Cdchamberlin · ‎07-17-2019

Do you suggest that I work on using Ansible? I want to automate our firewall changes. Can you give me a brief rundown of an example workflow that you or someone else has created for firewall changes? Hoping that I'll have an idea of what to work toward.. Right now, it's trying to mess with Postman.

Cdchamberlin · ‎07-17-2019

I have Panorama managing my firewalls. I would like to leverage Postman to make API POSTS to Panorama for new security policies. Can someone provide an example of a filled-out body with bogus data to show me how the API wants it? I'm particularily getting stuck on the first part of the body.. I have a device group called "firewalls" and the device is named "firewall1" { "entry": { "@name": "testrule", "target": { "devices": { "entry": [ null ] },

Cdchamberlin · ‎03-29-2019

The health check failure states 'Request Timed Out'. For NAT policies on the FW, I use Address Objects and map the FQDN of the ALBs. I can succesfully resolve the FQDN of the ALB which points to the Palo Altos, but I cannot resolve the ALB for the App Servers from the Palo Alto. They are in different VPCs. ALB Palo1 Palo2 = Can resolve from FW ALB App1 App2 = Can't resolve from FW I think it has something to do with the Palo not being able to resolve the FQDN of the ALB positioned 'lower' in the stack sitting above the App Servers.

Cdchamberlin · ‎03-28-2019

Trying to get the Palo Altos to register as healthy. Can anyone provide some assistance on NAT policies, or configurations for getting TCP 80 checks from ALB to Palo Altos to ALB which sits in front of two App servers? ALB (Palo Altos) | Palo Altos | ALB (App Servers) | App Servers

Cdchamberlin · ‎03-11-2019

Push.

Cdchamberlin · ‎03-11-2019

Hi @jperry1 , My concern with this design is the VPC attachment from TGW SN to the TGW. Rather than using ECMP VPN links 'that I have been unable to find documentation on', the data sent across that connection will be in the clear; right? What are your thoughts on that?

Cdchamberlin · ‎03-09-2019

Hi @jmeurer Any updates on the documentation? I'm interested in securing traffic flowing Inbound, East/West and Outbound with VPC insertion and VPN insertion. Particulary interested in taking advantage of ECMP VPN to connect the VM_SERIES to the TG. Any documentation would be greatly appreciated. Thank you.

Cdchamberlin · ‎03-09-2019

I'm looking at taking advantage of ECMP VPN to attach VM-SERIES to the Transit Gateway. I would like to use tunnel interfaces for this and would like egress/ingress traffic to go through the VM-SERIES appliances. Can somone that has implemented this design provide some feedback, steps and things to keep in mind? Thank you,

Member Since	‎03-09-2019 05:38 PM
Date Last Visited	‎07-05-2020 01:30 PM
Posts	14

Online Status	Offline
Date Last Visited	‎07-05-2020 01:30 PM

Re: AWS Transit Gateway

Re: Auto Scale Group - VM Series

Auto Scale Group - VM Series

POC in AWS - Palo Alto Active/Active under NLB

Palo Alto Active/Passive > eBGP to ISP > VLANs for ToR switches (Juniper)

Re: AWS Transit Gateway

Re: Create Post-Security-Rule - RestAPI

Re: AWS Transit Gateway

Re: Auto Scale Group - VM Series

Auto Scale Group - VM Series

POC in AWS - Palo Alto Active/Active under NLB

Palo Alto Active/Passive > eBGP to ISP > VLANs for ToR switches (Juniper)

Autoscale (manually created VM-SERIES) on AWS

Re: Create Post-Security-Rule - RestAPI

Create Post-Security-Rule - RestAPI

Re: ALB Health Checks -> Palo Alto -> ALB

ALB Health Checks -> Palo Alto -> ALB

Re: VM-Series to TG for ECMP VPN on AWS

Re: AWS Transit Gateway

Re: AWS Transit Gateway

VM-Series to TG for ECMP VPN on AWS

Network Security

Cloud Security

Security Operations