This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About ChristianBolelli
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About ChristianBolelli
09-28-2022
14Posts
0Likes
0Solutions
Sep 28, 2022Last Visited
User
Activity
User
Profile
Latest posts by ChristianBolelli
| Subject | Views | Posted |
|---|---|---|
| 1208 | 06-07-2022 07:41 AM | |
| 1232 | 06-07-2022 12:36 AM | |
| 1298 | 06-03-2022 01:20 AM | |
| 1986 | 04-07-2022 01:44 AM | |
| 2003 | 04-07-2022 01:29 AM | |
| 2489 | 04-06-2022 01:41 AM | |
| 2659 | 03-25-2022 07:42 AM | |
| 2798 | 03-25-2022 07:00 AM | |
| 2094 | 12-21-2021 12:12 AM | |
| 2152 | 12-19-2021 10:38 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like |
User Badges
Community Statistics
| Member Since | 04-02-2019 04:54 AM |
| Date Last Visited | 09-28-2022 06:29 AM |
| Posts | 14 |
06-07-2022
07:41 AM
Ah yes, now "Emea"and "US" are two DG where I can put a regional rules. For example on my scenario I can put under the Emea policy a rule that will be pushed on all 3 cluster but If the Emea and US still empty the firewall rule will be the same. Right?
... View more
06-03-2022
01:20 AM
Hello, Now my Panorama managing 4 cluster, 3 in Emea and 1 in US. This the Device Group organization. Shared Cluster 1 Cluster 2 Cluster 3 Cluster 4 Now we want to modify the organization to split the Emea Cluster and US Cluster: Shared Emea: Cluster1 cluster2 cluster3 US: Cluster1 Should be easy like that: Create 2 new empty Device Gruop "Emea" and "US" (parent device group will be Shared) For each cluster change the "Parent Device Gruop" from "shared" to the dedicated Region DG. Commit It's only a Panorama organizations or there are an consequences on the fws that can create an outage and I have to consider?
... View more
04-07-2022
01:44 AM
To make short a long story, I want to know if I can define a Secondary VPN that switches when the Remote Peer IP go down because the Customer want to avoid to monitor a resource inside the VPN. (Like on the ASA where we can simply set the secondary peer and it works without any other conf)
... View more
04-07-2022
01:29 AM
Hello, I'm trying to understand if it's possible to monitor the Remote Peer IP(Customer request) instead of a resource inside the tunnel IPSEC. So the ip assign to Tunnel.1 it not included in the ProxyID because I want to ping the Peer- ip Via CLI the ping works: PA>ping source "Tunnel.1-IP" host "Remote-Peer-IP" But with the same data on path monitor it fails.
... View more
04-06-2022
01:41 AM
Hello, Yes they allow icmp traffic I have now a lab. I've set an ip on the Tunnel.1 and a Path monitor as below: Tunnel.1 192.168.1.1/32 Static route Route1 10.10.10.0/24 interface Tunnel.1 Path monitor Src: 192.168.1.1/32 Dst: Remote Peer ip On Security rule Src:192.168.1.1/32 dst: Remote-PeerIP Application: Ping/icmp Nat original source: 192.168.1.1/32 Original dst:Remote-PeerIP Translated src: Dynamic ip and port. with the Palo alto Public IP Translated dst: original From CLI ping source 192.168.1.1 host Remote-PeerIP Answers as expected and we capture the traffic on test remote ASA and we see the icmp packets coming from Palo Alto public ip. But on Path monitor tab still in "down" state.
... View more
03-25-2022
07:42 AM
Hello, so the Path monitor MUST pass through the tunnel? In my example the Tunnel.1 ip shoud be natted with the PA outside interface and reach the public ip of the remote peer. The idea is to monitor the public ip and not and internal resources.
... View more
03-25-2022
07:00 AM
Hello, I have a vpn ipsec in production, now I have to add a secondary remote peer. It's my first time I have to configure a 2nd peer. If I understood well I can't simply add a seocndary peer to the VPN but I have to configure a new psec but the difference is the static route related the remote network. Example I should have: Remote net: 10.1.0.0/24 Route 1 10.1.0.0/24 metric 10 Tunnel.1 Route 2 10.1.0.0/24 metric 20 Tunnel.2 If the primary peer stop responding how I can turn off the Route 1? The tunnel.1 and .2 don't have an ip and the inside int of the PA it's not included in the local network Can I add an ip to Tunnel.1 like 192.168.1.1 and nat it with the external IP of the PA and set the Path monitor of the "Route 1" like Source:192.168.1.1 Destination: Primary Peer So the Route 1 ping the Primary peer If the peer stop responding the PA remove from the routing table the Route 1 and the Secondary VPN start working because the Route 2 it's the only active.
... View more
12-21-2021
12:12 AM
This option it's valid only for the selected Security profile so I can use different Sec prof with different Default action Exceptions Many thanks PavelK Kind regards, Christian
... View more
12-19-2021
10:38 PM
Yes I've tried but when I push Ok and closed Profile and reopen it the 57797 return on (alert)
... View more
12-17-2021
08:17 AM
Hello, My customer ask me to change the default action of several threats. I'm not able to see an Id that I can use to group some threat with the same action on the same rule. For ex. PHP Vulnerability scanning Detection (Default :Alert) I have to set to reset-both. On threat Vault I can see ID 57797 but on "Vulnerability protection Rule" I can add list of CVE or Vendor ID. I've tried to put the ID on vendor id but "find Matching Signator" show no match. I can creare a rule for any threat and fill the "Threat name" and in this case the Find show me the PHP thread It's the only way to change threat default Action if i don't have a CVE or Vendor ID? Regards, Christian
... View more
12-16-2021
06:51 AM
Thanks for the info. The steps should be: 1° remove and clear the interfaces (these interfaces are dedicated to the VR so no more used) 2° remove all static route 3° Disable the OSPF (uncheck the "enable" on the related tab) 4° delete the VR For the Fw rule should be similar 1° delete all fw rule where the Zone related the VR is present 2° remove the interface associated to the zone (the same of VR) 3° delete the Zone Best regards, Christian
... View more
12-16-2021
04:58 AM
Hello, I have a 5250 managed by a Panorama. On the firewall I have 4 Virtual router and I have to delete one because it's unused. Can I simply remove the VR via panorama by select the VR and delete it or there is some steps that I have to follow?(remove the interface from VR before or similar?) Note: Each VR it's a OSPF member. Should I expect an outage on the other VRs caused by the OSPF or for other reason? Regards
... View more
12-15-2021
02:33 PM
I have the same problem but I hope Palo Alto release an hotfix for 9.1 asap.
... View more
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks