Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
Network Security
- Prisma Access
- Prisma SaaS
- Prisma Cloud
- Prisma SD-WAN
- CN-Series
- VM-Series:
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
Security Operations
- Resources
- COVID-19 Response Center
About rmcrae
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About rmcrae
Tuesday
5Posts
0Likes
0Solutions
May 11, 2021Last Visited
User
Activity
User
Profile
Latest posts by rmcrae
| Subject | Views | Posted |
|---|---|---|
| 83 | Monday | |
| 96 | Monday | |
| 188 | 2 weeks ago | |
| 179 | 03-30-2021 02:42 PM | |
| 2102 | 03-01-2020 04:37 PM |
User Badges
Community Statistics
| Member Since | 02-26-2020 09:31 PM |
| Date Last Visited | Tuesday |
| Posts | 5 |
Monday
RDP to the target machine works when testing from another node in the same subnet so I've eliminated that. The configs have changed some at this point on the PA220 so my previous wire shark captures are no longer valid but traffic was previously reaching the target node but the target node was not able to return to the VPN client due to failing ARPs. We'll see how far we get tonight with trouble shooting.
... View more
Monday
I've updated the config so the VPN addresses are in their own L3 subnet and zone. I'm also fairly sure I updated the VR to make sure it had a route between the two as well as the security policy and PBF. I opened a support case with tech support to figure this out.
... View more
2 weeks ago
I managed to get GP VPN setup on my PA220 and get a Windows workstation to connect to it. It gets assigned one of the IP addresses reserved for VPN clients. When I attempt to connect RDP to a remote machines from this VPN client it fails. The VPN client is x.x.x.195 and the target machine is x.x.x.18 in the same subnet. When I check the monitor logs I can see incoming traffic from the .195 address but nothing coming back from the .18. I started a WireShark trace on the network and I can see that the traffic is reaching the .18 address but the .18 address is not able to return to .195 because it is failing to ARP for .195. What have I done wrong? PA220 running PanOS 10.x Windows 10 with latest 64bit GP Client
... View more
03-30-2021
02:42 PM
I use DHCP reservations to ensure the devices on my network get the same IP address every time. I have security and routing policies that depend on known IP addresses. Recently Apple, I’m sure other will follow, enabled a feature that by default that randomly selects a private MAC address when they lease an IP address. I realize that you can disable this feature on these devices but is there a way to prevent these random MAC addresses on the network in the first place? I’m looking for a solution that works from the networks point of view that doesn’t require me to black hole my Guest DHCP range. My device is a Palo Alto PA220. I'm aware of several articles on the net like: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HAutCAG
... View more
03-01-2020
04:37 PM
This is unfortunate. It would seem that it should be something that can technically be supported and other lesser FWs do support it. A PPPoE assigned IP address basically a DHCP address with authentication. This seems like it was intentionally decided to not support this configuration. Another issue I've noticed is with Policy Based Forwarding. If your Egress interface is assigned a dynamic IP (DHCP or PPPoE) then you can't select that as an next hop address. You have to assign it a static address for the hop. Lets just hope the ISP doesn't assign an new IP address with different next hop address for people in this situation.
... View more
LEGAL NOTICES
Copyright 2007 - 2021 - Palo Alto Networks
