About SutareMayur

SutareMayur

@CDeBella, What error are you getting? Mayur

SutareMayur

@mariocutroneo, Can you please paste traffic log snap here? Mayur

SutareMayur

@sedelman0 If you are putting static route with only exist/egress interface and next hop as none, then it should work. The only condition here is Route will be inserted into FIB table when mentioned interface is up. So post configuring such static route, do you see any arp learning on the egress interface? Please check. Mayur

SutareMayur

@Carracido If you are all good with configuration then yes there should be minimal downtime. But as a best practice, you should have Maintenance Window of an hour or two. This is just in case of disaster situation. Mayur

SutareMayur

@mariocutroneoWhat are you seeing in traffic logs? I think, NAT is not happening in your case. NAT statement seems to be wrong. Please put statement as given below. NATt: outside-isp2 to 'inside' -> destination address the ip of ISP2 - >destionation translation -> the address of my webserver Security Policy is Ok. Also if you still not able to access. Please see traffic logs and see if traffic coming from correct interface and NAT is happening properly. If it is still not working, then try by adding one static route for the ISP2 public IP (which is used for hosting web-server) towards ISP2 interface and IP address. If you want to pass internet traffic through ISP2 link, you can add PBF for specific source IP/subnets to route internet traffic from ISP2 link. So this PBF rule will override your default route present in VR. NOTE - As ISP2 is new link, can you please make sure you are able to ping next hop from Palo Alto interface. You can try to ping it from cli by taking source interface as IP address of interface eth1/3 (ISP2) and destination would be NEXT HOP or gateway of this link. Hope it helps you! Mayur

SutareMayur

@mariocutroneo No, no need of second Virtual Router. Just one question, are you going to use this link only for hosting internal server or for passing internet traffic too? Mayur

SutareMayur

@mariocutroneoYes it is possible. Terminate new ISP on one of the empty interface of firewall. Do the configuration like IP, ZONE etc. Then use public IP of new ISP to publish your webserver. Kindly configure source, destination zones in Security and NAT policies. Hope it helps! Mayur

SutareMayur

@decostersteven Glad to hear that. Thanks. You have a nice weekend, too! Mayur

SutareMayur

@csnowYou should be able to see it under gateway configuration Under Agent --> Connection Settings --> Disconnect on Idle Hope it helps! Mayur

SutareMayur

@decosterstevenThere you go. It will never work if you keep that port in vlan99 as subnet 10.0.30.x is not part of vlan99. You need to keep it as trunk as you have multiple sub-interfaces configured on 1/3. Mayur

SutareMayur

@decosterstevenCan you verify what's configuration present on Switch interface Fa0/16? I am suspecting issue with it now. Mayur

SutareMayur

@decosterstevenWe can have zoom session if you are ok with it. I can check it. If you put default gateway as 10.0.30.1 on switch, now traffic will go from Wireless zone as source, Do you have policy/NAT for it? Mayur

SutareMayur

@decostersteven, I'm not insisting to use 1/2 for LAN traffic. You have used 192.168.99.x on 1/3 which is overlapping with MGMT interface subnet. So Either change this subnet or use 1/2 as your LAN interface. I think due to this overlapping, when you try to connect to MGMT interface, the traffic is going on interface 1/3 (can you check logs for this). Actually your MGMT traffic should to directly via MGMT connectivity. Mayur

SutareMayur

@CHKlomp It's 1 00 SSL VPN users. Mayur

SutareMayur

Yes, you can use interface 1/2 of PA for this. And use that IP as a default gateway on switch. 1/2 can be act as Inside interface on PA. Mayur

SutareMayur

@decosterstevenWhy are you using same subnet i.e. 192.168.99.x for other interfaces on Palo Alto? Also why IP is configured on Eth1/3 as it is already configured as sub-interface? If you want to forward normal traffic/LAN traffic towards firewall, you can use Eth1/2 and then out default route towards it on switch. Mayur

SutareMayur

@KJamesPlease brief us more on the issue - 1. When you start facing issues, have you checked the traffic logs on firewall? Do you see traffic hitting firewall? 2. Please check route print on affected system during issue. Is there any IP conflict happening? Mayur

SutareMayur

@CyrilBIt will work the way it is working for two client pools. Mayur

SutareMayur

@decostersteven There is confusion here. Let me put everything here, 1. Your default route under Virtual Router should be towards 192.168.0.1 2. Under Management interface settings, configure below points, IP Address - 192.168.99.1 Subnet Mask - 255.255.255.0 Default gateway - 192.168.99.2 Here your default route and Default Gateway for Management interface are separate configs and used for separate traffic. Default Route under Virtual Router is applicable for DATA Plane traffc. And Default gateway configured under Management interface settings is used for MGMT Plane or Management interface traffic. Hope it is clear now! Mayur

SutareMayur

@decostersteven, You can't configure security zone on MGMT interface. As you have configure MGMT IP as 192.168.99.1/24, make sure you have also configure proper gateway to this. Also enable services given in my earlier post. Now you should be good to go. Hope it resolves your issue now! Mayur

SutareMayur

@decostersteven, Please check below few points - 1. Network Configuration on the PA interface where subnet 192.168.0.0/24. If it is properly configured or there is some mis-configuration in subnet mask as you have management segment in 192.168.x.x. 2. Make sure on Management interface, you have enabled services like 443, ICMP etc to enable these services on MGMT interface. Also see permitted IP Addresses field. As there is incorrect zone, please verity first point. I am suspecting issue with this. Also check what is gateway configured for MGMT interface and subnet mask. Mayur

SutareMayur

@IanBroadwayYes you can go to directly 9.0.6 from 8.1.5 but only thing you need to keep base version 9.0 downloaded. Once Base version is downloaded, then download target version and install it. It is recommended path when moving from one feature release to the next is to download the base image for the next feature release version and then download and install your target maintenance release version. You must have both the base image and the maintenance release image on the firewall for installation to be successful. Hope it helps! Mayur

SutareMayur

Hi @Yusuf_PA , If you want to route internet traffic via PBF, you can put PBF rule as follows - Configure 1. Source and destination zones, Source IP address/subnet 2. Destination address would be any as it is internet traffic 3. services & apps according to your requirement (You can put any as well) 4. Under Forwarding, actions should be 'forward' 5. Select Egress interface from dropdown (Here select interface where ISP internet link is terminated) 6. Select Next Hop as 'IP Address' and define ISP gateway IP address. So once PBF is matched, that traffic will be forwarded to mentioned IP address. Hope this helps you! Mayur

SutareMayur

@Stephen24, Yes above mentioned test command will give you the security rule match for mentioned source and destination traffic. This will confirm if traffic is matching desired policy and confirm on traffic action. Mayur

SutareMayur

May i know affected gateway model? Mayur

SutareMayur

@raji_toorWhats error shown on gateway? Mayur

SutareMayur

@UfukBAYGIN, Are you running on 5.0 GP version? There are certain changes in this version of iOS if compare to older version. The certificate location of certificates in iOS 12 and newer is different than older iOS version so you need to re-import certs. Please refer this - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boSUCAY Also https://live.paloaltonetworks.com/t5/General-Topics/GlobalProtect-5-0-for-iOS-12-and-User-Certificat... talks about same issue. Hope this resolves your issue! Mayur

SutareMayur

@FarzanaMustafaIf you are talking about advanced licensing for HIP Checks, GP mobile app or IPv6 support, then it will never limit gateway's no of users capability. Hope it resolves your query! Mayur

SutareMayur

@Deepak_KCan you please share pbf written? Mayur

SutareMayur

@Deepak_K, Please verify below points, 1. Is PBF rule getting applied for initiated traffic? 2. When you route internet traffic towards ISP2 gateway via static routing, is it working? Mayur

Date Registered	‎02-06-2020 05:27 AM
Date Last Visited	Monday
Total Messages Posted	186
Total Likes Received	52

Online Status	Offline
Date Last Visited	Monday

Enterprise

Prisma

Cortex

About SutareMayur