About Stevenjwilliams83

Negative. When I check the clients they are not inheriting the DNS server IPs.  ... View more

I think some of the issues I am running into is we have business units within our organizations, and now that I think of it I should have ran multi vsys for each one which would have kept their rules "segregated" But now I am trying to slam all these rules into one vsys and one large policy.  ... View more

I get the port/services thing, Layer 7 vs Layer 3.    I do not think specific source and destinations is a bad thing.    ... View more

So I have business units within my organization. So in the ASA world I would have an ACL called BU01_access_in. This would dictate what traffic behind the interface named "BU1" can talk to. Nothing else on any other interface can talk into the interface unless allowed within the ACL.   So if I want to build groups of rules based on TAGs like BU01 I would need to make sure all traffic it needs to access and all traffic that needs to access it is defined because then I would want to build a deny rule from the sources of BU1 to any and Any to BU1. So that deny would only affect that group of rules for the BU01. Palo gives you flexibility to build rules many different ways, so its hard to decide on a "best way".   examples:   rule 1 - Allow BU1 server network to Domain controllers (in different networks) rule 2 - Allow BU1 server network to NTP Servers (in different networks) rule 3 - Deny BU1 server network to RFC1918 rule 4 - Allow BU1 server network to Internet rule 5 - Deny BU1 server network to ANY rule 6 - Deny ANY to BU1 server network   so this means that domain controllers in any other subnet beside BU1 servers wont be able to communication inbound to the server network because of the last rule.    I need to deny to rfc1918 because I do not want the server subnet to talk to any subnet it shouldnt unless allowed.  I need to allow an any after the rfc1918 for servers to get to internet for things like DUO MFA, Cloud based apps, etc, etc.  Maybe that last rule isn't needed?  ... View more

everything I have been reading seems to elaborate the use MFA DUO for global protect.  ... View more

I wanted to add something here that I thought might be helpful. The recommendation is 100g of space for log exports. The larger my ruleset became the more space each log started taking. I have about 700 rules atm and I can only keep 1 log from each FW in my HA pair. If I forget to process logs (because for some reason automatic log process has never worked for me) your space fills up and you cant actually process the logs due to the fact there is not enough room.  I would say 100g is a minimum but keep in mind your environment and how much traffic you have traversing the PAs.  ... View more

I cannot seem to find device manager for mac...have a link for it? ... View more

HA!! That is the missing piece. For some reason I was thinking i didnt need to do that cause normally for a prod use I would get trusted 3rd party and wouldnt need to.    ... View more

I have global protect gateway and portal licensing. I am testing at my home on my 220, but this going to be a request at my place of employment for sure when we roll it out.    The logs are showing some errors but not sure what to look for.   P7694-T11531 Sep 29 17:08:36:652833 Error( 522): Server trust evalutaion failed: 5 connection: 0x10440aff0, type: 1, host: [globalprotect.thenetworktransit.com:443], original host: [globalprotect.thenetworktransit.com], alwaysTrust: 0 session: <__NSURLSessionLocal: 0x104711e40> -[GPURLConnection session] <NSOperationQueue: 0x1047119a0>{name = 'NSOperationQueue 0x1047119a0'} identity: (null) scepIdentity: (null) connectionGroup: <OS_dispatch_group: 0x10440b120> distinguishedNames: (null) request: <NSMutableURLRequest: 0x104423e50> { URL: https://globalprotect.thenetworktransit.com:443/global-protect/prelogin.esp } response: (null) responseError: (null) isHandshakeStarted: 1 trustedServerCertificates: (null) priorityIdentities: (null) serverCertificatesChain: ( "<cert(0x108807800) s: globalprotect.thenetworktransit.com i: IntermediateCert>", "<cert(0x10482ce00) s: IntermediateCert i: RootCert>", "<cert(0x10482d400) s: RootCert i: RootCert>" ) trustExceptionSHA256: ad:ff:f0:47:92:39:d2:db:15:29:21:ad:54:a3:bf:6c:d9:f4:48:01:d0:fe:d4:36:98:12:65:b1:20:ad:b9:ca error: Error Domain=GPURLConnectionErrorDomain Code=2 "(null)" UserInfo={ServerCert=<cert(0x108807800) s: globalprotect.thenetworktransit.com i: IntermediateCert>, trustChain=( { Certificate = "<cert(0x108807800) s: globalprotect.thenetworktransit.com i: IntermediateCert>"; Property = { type = error; value = "Root certificate is not trusted."; }; }, { Certificate = "<cert(0x10500a400) s: IntermediateCert i: RootCert>"; Property = "<null>"; }, { Certificate = "<cert(0x10500aa00) s: RootCert i: RootCert>"; Property = "<null>"; } )} connectTimeout: 5 receiveTimeout: 30 responseData(0): (null) P7694-T12803 Sep 29 17:08:36:655791 Error( 391): Connection error Error Domain=NSURLErrorDomain Code=-999 "cancelled" UserInfo={NSErrorFailingURLStringKey=https://globalprotect.thenetworktransit.com:443/global-protect/prelogin.esp, NSLocalizedDescription=cancelled, NSErrorFailingURLKey=https://globalprotect.thenetworktransit.com:443/global-protect/prelogin.esp} response:(null) connection: 0x10440aff0, type: 1, host: [globalprotect.thenetworktransit.com:443], original host: [globalprotect.thenetworktransit.com], alwaysTrust: 0 session: <__NSURLSessionLocal: 0x104711e40> -[GPURLConnection session] <NSOperationQueue: 0x1047119a0>{name = 'NSOperationQueue 0x1047119a0'} identity: (null) scepIdentity: (null) connectionGroup: <OS_dispatch_group: 0x10440b120> distinguishedNames: (null) request: <NSMutableURLRequest: 0x104423e50> { URL: https://globalprotect.thenetworktransit.com:443/global-protect/prelogin.esp } response: (null) responseError: Error Domain=NSURLErrorDomain Code=-999 "cancelled" UserInfo={NSErrorFailingURLStringKey=https://globalprotect.thenetworktransit.com:443/global-protect/prelogin.esp, NSLocalizedDescription=cancelled, NSErrorFailingURLKey=https://globalprotect.thenetworktransit.com:443/global-protect/prelogin.esp} isHandshakeStarted: 1 trustedServerCertificates: (null) priorityIdentities: (null) serverCertificatesChain: ( "<cert(0x108807800) s: globalprotect.thenetworktransit.com i: IntermediateCert>", "<cert(0x10482ce00) s: IntermediateCert i: RootCert>", "<cert(0x10482d400) s: RootCert i: RootCert>" ) trustExceptionSHA256: ad:ff:f0:47:92:39:d2:db:15:29:21:ad:54:a3:bf:6c:d9:f4:48:01:d0:fe:d4:36:98:12:65:b1:20:ad:b9:ca error: Error Domain=GPURLConnectionErrorDomain Code=2 "(null)" UserInfo={ServerCert=<cert(0x108807800) s: globalprotect.thenetworktransit.com i: IntermediateCert>, trustChain=( { ... View more

Read it. Labbed it. It works. But "routing" doesn't solve LAN side requirements for hosts all the time. Not every corporation is running nexus as their core, not every corporation is stacking or using VSS. "Routing" doesnt solve a gateway problem.  ... View more

I was just trying to understand the question of why do I think the standby node would receive traffic.  ... View more

How do you figure? If each palo is learning each HSRP group VLAN via a routing protocol and both core switches own an SVI for that vlan, network is now connected. So OSPF will see the same subnet for a single vlan on each core switch as connected and based on ecmp will have a 50/50 shot of sending it the right node.  ... View more

Avoid the stacking because in-service upgrades give me PTSD. No NAT because they are Core Firewalls. Would like to use ECMP but it seems to be a headache. And even with Active/Passive and HSRP there is still the issue that there is a 50 percent chance that the active firewall will send the return traffic to the standby HSRP node.  ... View more

Now, I am fantasizing here, but I thought about running HSRP egress side to the palos and running palos with floating IP (essentially vrrp).... ... View more

Cat9500s not stacked, no VSS, no Nexus core running active/active HSRP. So doesnt qualify.  ... View more

Not running active/active for increase performance because I know you get maybe 20% on that. I am using it because I have two active core switches and it becomes a load share game. Do ditch HSRP and use what for LAN side? thats the real challenge.      ... View more

Ya what I figured out was that without any HSRP trickery or some kind of BGP attribute to influence routes . inbound, each palo is always going to choose Core SW01 due to lowest router-id. I guess I could migrate to GLBP or just stack the 9500s in VSS.  ... View more

The culporit in this whole thing is HSRP. The design of HSRP is flawed as each vlan has an active and standby hsrp peer. Because the vlan network has an SVI on each HSRP peer regardless of active or standby, the network is known as connected and tells this to each palo alto. So the palo alto sees each downstream HSRP peer as equal cost, so it at times sends return traffic for that said vlan to the standby HSRP peer and I assume the ARP and MAC address as some mismatches doing on since from the clients aspect the gateway address for the HSRP group sends a virtual mac, but when traffic returns the peers use their real mac and not the virtual.    So I can fix this by just turning off ECMP on the palo altos which means I will use ecmp from the core 9500s out to the rest of the network but return traffic will only return on one path. BUT what I do not get is that if I am setting my ECMP with symmetric return why would it ingest traffic from the active hsrp peer and not send it back to the same peer as the reason for symmetric return is "return traffic on the same interface it was received on"     ... View more