This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About KunalChopra
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About KunalChopra
05-09-2022
17Posts
0Likes
0Solutions
May 09, 2022Last Visited
User
Activity
User
Profile
Latest posts by KunalChopra
| Subject | Views | Posted |
|---|---|---|
| 950 | 03-15-2022 08:21 AM | |
| 962 | 03-15-2022 08:15 AM | |
| 3156 | 12-23-2020 03:26 AM | |
| 3227 | 12-22-2020 05:01 AM | |
| 4022 | 05-11-2020 01:41 PM | |
| 4303 | 05-11-2020 01:20 PM | |
| 4342 | 05-11-2020 12:46 PM | |
| 3281 | 05-11-2020 09:36 AM | |
| 2319 | 05-10-2020 11:01 PM | |
| 4798 | 05-10-2020 10:18 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like | |||
| 1 Like |
User Badges
Community Statistics
| Member Since | 09-17-2019 12:02 AM |
| Date Last Visited | 05-09-2022 02:44 AM |
| Posts | 17 |
03-15-2022
08:21 AM
Hi Team, There is a situation where I need advice w.r.t Paloalto VM series firewall in azure. Currently, we have deployed Firewalls behind azure public load balancer in Active/active mode. Now there is a requirement where I need to deploy these firewalls in Active/passive and I am confused on how to check the load on VM firewall as they are getting migrated from active/active to active/passive. What should be the way forward If I want to check the current traffic load and check if I can share the load of two firewalls in a standalone firewall. Do I need to check peak traffic? Cpu cores? disk? Basically how to clear sizing issues in this migration.
... View more
03-15-2022
08:15 AM
Hi Members, I have deployed paloalto VM in Azure public cloud and I am in middle of migrating a voice application which uses around 30k ports . Now challenge is that on azure external load balancer , how should I implement all protocol Nat as it external LB doesnt have that feature. For ex if my application hits on port XYZ on load balancer , then it should NAT as it is towards my paloalto firewall and then firewall takes it to real server. can anybody advise on it? VM-Series @reaper thanks in advance
... View more
12-23-2020
03:26 AM
No there is no option of removing NAT functionality from LB. I think the only option left is to enable XFF under URL filtering .what say ?
... View more
12-22-2020
05:01 AM
Hi Members, I have a setup in GCP cloud wherein I have to deploy set of vm series palo firewalls between load balancer and real servers. The problem is I need to know the exact IP address of the client whereas if you see in firewall logs, you will get to see only the IP address subnet of external load balancer. can anyone help me on this ?? thanks in advance @reaper
... View more
05-11-2020
01:41 PM
cheers and hope it gets resolved !
... View more
05-11-2020
01:20 PM
follow this link and you will get to knoq https//docs.paloaltonetworks.com/pan-os/8-0/pan-os-new-features/globalprotect-features/split-tunnel-to-exclude-by-access-route Please mark this as solution if you get the resolution .This will help others.
... View more
05-11-2020
12:46 PM
Hey , just enable the split tunneling and add IP's of your office network for which vpn connection should work otherwise all other remaining traffic would go by other connection. So yes enable split tunnel in gateway config of gp Hope it helps
... View more
05-11-2020
09:36 AM
You need to have clarity over the basic minimum network infrastructure in order to size PA firewall. For ex :- How much is the current bandwidth of customer ? what many approx users are ? is there any other type of internal traffic which would use firewall other than normal internet ? Also it should not be VDI infra in in which 1 user is counted as many user .? whatever you mentioned in thread , I guess it will be PA 220 vs PA 820..
... View more
05-10-2020
11:01 PM
I agree with @reaper that firewall doesnt support port spanning in itself but you can go for one alternative which I always prefer. Span the port of switch which is connected to firewall interface you want to monitor and then connect the mirrored port to your server . It will more or less serve you the same purpose. Hope it helps ..Cheers !
... View more
05-10-2020
10:18 PM
you should not see any logs in your firewall if some intermediate device is blocking it and that way it can be confirmed. Or if you want to dig in further , just apply packet capture with both ends public ip in filter. Cheers
... View more
05-10-2020
10:10 PM
ideally if you have allowed ports , then it should work . for better security/clarity , instead of using service ports , you can use ipsec related applications as mentioned in earlier post . Now , if it is still not working , then i would suggest you to check logs and see what exactly is getting denied and then allow it by ports OR application. NOTE :- allow logging in default policies to see deny logs if it is hitting those policies Hope it gives you a direction
... View more
- Tags:
- deally
05-10-2020
06:49 AM
I think whatever you get to see in best practice document of PA ( which I hope you followed ) , then that is sufficient for now . Rest you can customize at later stage once you know the effects of zone protection on your live traffic.
... View more
- Tags:
- think
01-14-2020
11:26 PM
@reaper any comments ?
... View more
01-14-2020
11:26 PM
I am not sure but i think PA 220 without decryption can handle 160 mbps of bandwidth with all engines activated. Also session is not an issue because currently at peak they are having nearly 15k session way less than 64k supported on our box
... View more
01-14-2020
07:41 AM
Hi kiwi , ok can we say that if we enable security profiles on all rules on PA 220 ( excluding SSL ) , then firewall will give 260 mbps of throughput ? or in other words , in my case customer has 160mbps of bandwidth ( 2 isps 80mbps each ) , so can i size PA 220 for this situation assuming I am enabling all profiles ?
... View more
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks