About chuckles

chuckles · ‎05-13-2020

atm my palo-alto 8.0.7 have a remote vpn "Global Protect" that is working fine but with a self signed certificate that gives a warning , can someone please tell me how do i create a certificate for GP and sign it with a trusted party DIGIcert ? what are the steps?

chuckles · ‎04-23-2020

so i would put the public ip of the internal server in the rule not the private ip after nat?

chuckles · ‎04-23-2020

I have an internal server which i want to publish its service to public and need to do ssl decryption, does that means i need to do "inbound ssl decryption"? and if so, as the website is natted from outside to inside, in the decryption rule in the destination, do i put the public ip or the natted ip?

chuckles · ‎03-15-2020

as you know QOS show you live statisics for the class and how much bandwidth it is using , my need is to get historical data for the same thing but like throughout the last month? is that possible?

chuckles · ‎07-07-2019

can i upgrade from 8.0.17 to 8.1.7 directly? also would going to 8.1.7 change any of my current config?

chuckles · ‎05-22-2019

it worked! thanx but i dont understand what difference is between doing it this way and the licensed mobile devices vpn? is xauth relieble? i dont want to get stuck in the future with alot of technical vpn issues?

chuckles · ‎05-22-2019

i created a remote vpn with gateway and portal , but in both configs i set the local authentication in the authentication tab after the ldap but if the ldap authentication fails it wont fall back to the local authentication?

chuckles · ‎05-22-2019

i successfully configured remote vpn client for windows to function but the customer is asking for vpn using mobile phones? would it work with the exist configuration? or does it need other kind of configuration? does the mobile phone pull the client from the palo alto as well?

chuckles · ‎05-21-2019

i created a remote vpn and a vpn zone for local users , i created a security rule from vpn zone into inside but the problem is when i try to set certain access for different users , when i type the user name it doesnt auto complete it or list other local users in the security rule? shouldnt it list all the local users created to choose from them? or auto complete a user name ? it is like the user section in the security rule cant see my local users i created?

chuckles · ‎05-19-2019

i have a PA-220 , can i limit bandwidth for certain subnets , for example limit a guest subnet for 10 mbps while let other subnet take 20 mbps? if so how do i do that?

chuckles · ‎05-15-2019

that article is complicated and also not my goal as i dont want a primary and secondary isp , i want to use a certain subnet to use a second isp , do i do that by policy forwarding on the palo alto? do i create a rule with the inside subnet as source and destination as any , then set the egress interface to the second isp outside interface and the second hop as the isp router public ip which is directly connected? will i need to nat "PAT" from inside to outside with the second outside interface? will i need a security rule as well from inside to second outside interface? please help

chuckles · ‎05-15-2019

Hi, is that done on palo alto? how do i do that? Regards,

chuckles · ‎05-15-2019

the customer have added a extra isp router which i need to route a certain subnet through it for internet , the problem the default route 0.0.0.0/0 already route interent through the old outside interface , how do i route the specific inside subnet to the internet through the second outside interface?

chuckles · ‎05-13-2019

the switch can reach the inside interface of the PAN as the inside network can reach the internet , but i dont understand how do i make route in the pan for the vpn subnet? like the vpn ip pool have no interface? do you mean like give the tunnel interface an ip address in the same vpn ip pool addresses and set a static route for the vpn ip pool through the tunnel ip address?

chuckles · ‎05-13-2019

im having big problem , after my remote vpn connects i cannot reach my internal network even though my core switch is directly connected to palo alto , i checked i set the access range for the vpn for 0.0.0.0/0 and i set a security rule from vpn zone to inside zone , also i can ping the inside interface on the firewall itself but not the directly connected core switch , when i check the traffic under monitor it all shows "aged out" , i even set a ip route to the vpn ip pool pointing to the inside of the firewall but with no use , im at a lose here

chuckles · ‎05-12-2019

they are in the same subnet

chuckles · ‎05-12-2019

im facing issue where a firewall with a outside interface is not receiving public ip adresses from the isp router , the isp router is showing it is own interface which is connected to the firewall as the arp destination for the public ip subnet instead of the router , so i was wondering can i add multiple ip addresses to the PA layer3 outside interface?

chuckles · ‎05-09-2019

in my firewall i use certain ip addresses for outside to inside natting and for security policies , but im wondering , under objects do i need to specify the subnet mask "/24 , etc" for each object host or not? i specified the mask for the inside and outside interfaces ip addresses but what about the objects in natting and security policies?

chuckles · ‎05-07-2019

but how the security policy destination ip should be , is it the public ip or the translated private ip like:- allow outisde to inside , source any ip , destination "public" or "translated private ip"???

chuckles · ‎05-07-2019

but is my nat rule correct? if i set the original traffic coming into udp 8443 , does the translated private ip also use udp? as there is no option to use udp or tcp in the translated port also how the firewall rule should be for the destination? should i make the (outisde>>inside) rule destination ip the translated private ip or the public ip?

chuckles · ‎05-07-2019

i have a situation where outside users will tupe in a public ip which the palo alto will nat it into a inside privtae address like destination "public" x.x.x.x port udp 8443 >>> translated destination "private" y.y.y.y udp 8443 ,but when i tired to do it i couldnt set the tanslated address port to tcp or udp? does it take the same tcp or udp set in the original service port? also is my config correct for this nat?

chuckles · ‎05-06-2019

i appliied a security rule and did a security profile on it but after applying it im getting this message

chuckles · ‎05-06-2019

What about remote vpn ? Can i set remote vpn with my current license? Or do i need extra licenses?

chuckles · ‎05-06-2019

im having difficulty understaing the licensing on palo alto , from the attached pictures do i have the anti-virus , vulnrability protection , anti-spyware , url filtering , file blocking , data filtering and wild fire? or does each of them need a license to be active? and applied to rules?

chuckles · ‎05-06-2019

is it possible to set the mgmt port ip subnet same as the inside interface ip subnet? or it needs to be different subnet?

chuckles · ‎05-05-2019

i thought thew HA1 connection between two mgmt palo alto need to be dedicated , so from what you saying i can use the mgmt port for both HA functionality and for mgmt port roles"dns , updates etc"

chuckles · ‎05-05-2019

i have a small new palo alto , i have read i should use mgmt port for HA1 with the second palo alto , but if i do so how can i make up for the mgmt port important functionalities like updates and dns if i use it for HA? im confused

chuckles · ‎05-05-2019

what do you mean by service routes?

chuckles · ‎05-05-2019

i have a core switch and a router which connects to other router to reach the internet , i was wondering if i put the palo alto as a VWIRE between the core switch and the router would i be able to control which ip addresses can go to the internet and which cant? like create security policy rules for ip addresses on a palo alto set as a Vwire?

chuckles · ‎05-05-2019

this is my first time deploying palo alto , is it important to have the managment port connected? does it play important role in the device function or is it just solely for managment? like can i manage the device from the inside interface only?

Date Registered	‎05-05-2019 02:10 AM
Date Last Visited	‎05-13-2020 06:08 AM
Total Messages Posted	30

Online Status	Offline
Date Last Visited	‎05-13-2020 06:08 AM

Strata

Prisma

Cortex

About chuckles