About SteveBallantyne

Hello all, I currently have a case open with support on this issue. But I am looking for some customer feedback.   We presently have *two routes* and two separate firewalls. 10.0.44.1/22 on my Palo Alto, and 10.0.45.1/22 on a legacy Cisco L3 router. The Cisco has been stripped down and only really serves as a default route to a end of life firewall. My goal is to lift 10.0.45.1/22 from the old Cisco router and place it on my Palo Alto. In so many words ... I want to create a "secondary" IP address on the same subnet so that 10.0.45.1 and 10.0.44.1 are used interchangeably.   If I try to add these two addresses on the same one interface, the Palo rejects the changes with overlapping subnets. Support had suggested using a separate physical interface. But that gave me the same error message.   EDIT: This is on a Palo Alto PA-3250   Most of the articles and posts I have looked at for this issue point to a customer VPN where two remote sites have the same subnet(s). That doesn't really apply to my case here, and the solutions don't really make sense for this scenario.   Any help or pointers would be appreciated! ... View more

Hello community, I am attempting to create a VXLAN over IPSec solution between my PA-3250 and a remote Fortinet FortiGate 61E. I have managed to get things configured correctly on the FortiGate (I think) as I am seeing the traffic entering on the Palo side.   I am using Tunnel Inspection on the Palo side and it appears to be set up correctly. In the Monitor > Tunnel Inspection on the Palo, the traffic can be seen there. Even though when I click the magnifier to take a deeper look on the flow the "Tunnel Inspection" checkbox is NOT checked, which seems strange to me.   I created a security rule for phone traffic and I am seeing that traffic pop into my standard Palo Monitor > Traffic > Logs. But the applications are all coming up "Incomplete". I am also not able to ping back and forth.   So it appears everything works - with the exception of the routing. And I am not sure how to fix that?   Has anyone here done multiple VLAN's over a VNI using VXLAN over IPSec? If so - how did you get your traffic to *route* correctly? ... View more

Hello community - I have a case open with support, but I am looking to see if anyone else has an idea for me while they are looking at my tech support files.   I attempted to upgrade an active/passive HA pair following the Palo Alto Doc. I upgraded the secondary from 8.1.4-h2 to 9.0.3 and rebooted. I am now at the step where I would suspend the primary and fail over to the secondary. But my HA pair is broken.   Here is what shows on the Dashboard of my primary ...   Mode Active-passive Local Active Peer (172.17.1.11) Unknown Running Config Synchronized   App Version Unknown Threat Version Unknown Antivirus Version Unknown PAN-OS Version Match GlobalProtect Version Unknown HA1 Down HA1 Backup Down HA2 Down   I find it odd that it shows a version match for the PAN-OS Version, when in fact, the secondary is running 9.0.3? ... View more