About bgmncwj

Has anybody been successful in getting MP-BGP up and running over IPv6? Currently whenever we try to enable it to add v6 routes from AS7018 the commit fails and leaves the routed daemon on the dataplane in such a state that the only way to fix it is to reboot the 3060. Thankfully it continues to pass traffic and we're running in Active/Passive but it still seems like that pretty catastrophic. We've only tested this on 8.0.2 (upgraded from 7.1.9).   If you do have it running, mind sharing how you have it configured? I've got a support case open now (660333) but so far they've just been able to confirm the settings look correct. ... View more

We have an internet facing SFTP server for our customers to use and I wanted to enable SSH decryption to see into that traffic and potentially auto-block IPs trying to bruteforce their way in. However whenever I enable SSH decryption the SFTP session connects fine but after 128k uploaded it just stalls out. Is that expected behavior? I've tried to add ssh-tunnel to the security policy but that didn't make much of a difference. ... View more

We recently had a case where we were seeing high  proxy_wait_pkt_drop and SSL decryption sessions were taking a while to connect. After a week or two of back and forth support advised us to disable Certificate Revocation Checking (both CRL and OCSP) under decryption settings and that appears to have fixed the issue. Support also mentioned that those settings were just checking the revocation status of our ssl-forward-trust cert and doing us no good anyway and the box independatly pulled CRLs. That doesn't sound right to me, is that correct? And if so how do we block sites with revoked certs, https://revoked.badssl.com/ now seems to be signed by our ssl-forward-trust cert with no issue. How can we prevent signing revoked certificates? ... View more