Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
- Panorama
- AIOps for NGFW
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- Cloud NGFW for AWS
- CN-Series
- VM-Series:
- Private Cloud
- OCI
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
- Cortex Xpanse
Security Operations
- Resources
- COVID-19 Response Center
About DanaHawkins
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About DanaHawkins
05-11-2022
12Posts
2Likes
1Solution
May 11, 2022Last Visited
User
Activity
User
Profile
Latest posts by DanaHawkins
| Subject | Views | Posted |
|---|---|---|
| 300 | 03-02-2022 07:41 AM | |
| 390 | 03-01-2022 12:58 PM | |
| 260 | 03-01-2022 12:48 PM | |
| 94 | 02-28-2022 09:39 AM | |
| 816 | 02-25-2022 02:22 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 02-24-2022 11:25 AM | |
| 1 Like | 02-24-2022 11:38 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like |
User Badges
Community Statistics
| Member Since | 03-25-2020 11:11 PM |
| Date Last Visited | 05-11-2022 07:02 PM |
| Posts | 12 |
| Total Likes Received | 2 |
03-02-2022
07:41 AM
Yes and no. Remember GWLBs and TGWs serve specific purposes. If you just want VPC to VPC connectivity you can use VPC Peering. If you want to inspect traffic VPC to VPC using a pair of PAN FWs, you would use GWLB. If you want to perform dynamic routing with BGP over IPSec to on-prem with AZ redundancy, the TGW is still a good option. With the GWLB architecture, the firewall takes over the routing that would normally be done by the TGW (Hub and Spoke RT). That is because each GWLBe is mapped to an interface and zone on the FW and native routing is used. It's also much faster. In the old architecture, the Palo's had to have an IPSEC tunnel to the TGW which was limited to 1.25Gbps.
... View more
03-01-2022
12:58 PM
Best practice is to setup an inbound NAT on a port other than TCP/80 or TCP/443. For instance, use an inbound nat on port TCP/8888 that NATs to 443 with a destination of your back-end server. You can also check the reference architecture guide well. https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/guides/azure-architecture-guide
... View more
03-01-2022
12:48 PM
I would take a look at the Palo Alto Azure Reference Architecture Guide. https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/guides/azure-architecture-guide. In short, you have to configure UDRs to get traffic over to the Palo Alto for inspection.
... View more
02-28-2022
09:39 AM
This would be true if you were only using AWS native constructs but introducing the Palo Alto FW in the "Transit" VPC would allow you to pass traffic/inspect traffic by sending traffic to a VPC subnet ENI resource to another subnet ENI resource. In effect, the Palo Alto FW becomes the "transit router" for the VPC. VPCs as AWS native constructs are non-transitory in nature but a FW can act as the bridge.
... View more
02-25-2022
02:22 PM
The firewall is acting as the intermediary. VPC peer allows for connecting of resources between VPCs. @sthornton You are right that, if there was no firewall, or another intermediary, within the VPC then you would not be able to communicate from VPC1 to VPC2 via VPC3.
... View more
02-25-2022
06:15 AM
You achieve what you want with VPC peering using a design similar to the picture I posted above. Transit Gateways give you the benefit of Availability Zone redundancy and using BGP for route propagation between the firewalls and AWS. Using VPC peering all route table configurations are manual for both the firewall and AWS.
... View more
02-24-2022
11:42 AM
After you attach the NICs to the Palo Alto you will need to reboot.
... View more
02-24-2022
11:38 AM
1 Kudo
You will need to associate an AWS EIP (External IP) to the interface on that PAN that the GPGateway lives on. External users will connect to the EIP and be Nat'd to the DHCP address on the firewall. Even though the IP is DHCP it won't change as long as you don't terminate or detach the interface from the firewall.
... View more
02-24-2022
11:29 AM
Another thing to keep in mind is that if you added more subnets within the VPCs you would need to consider the PA VM instance size. I believe you need a C4xLarge just to have the proper number of interfaces to place in each subnet. With more than 4 interfaces you would need to go to bigger instance size and it will start getting pricey.
... View more
02-24-2022
11:25 AM
1 Kudo
This is a very odd setup. Why do you have a firewall in every VPC? By default subnet-2-subnet traffic within a VPC is not going to be inspected by the PA. it would be more practical to use VPC3 as the primary "Security VPC" inspecting traffic passing between VPCs. With that said, your design CAN work but you would need a RouteTable in every subnet, please see below. I only included VPC1 and VPC3, you can duplicate the configuration for VPC2.
... View more
02-23-2022
08:19 AM
I'm doing a Secure SDWAN PoC with a customer this month and they asked if Panorama offered the ability to pull/poll realtime metrics related to SDWAN performance. My first thought is you can pull standard SNMP metrics from any interface including the SDWAN interface. My second thought was using Netflow.
But my question would be surrounding pulling SDWAN specific metrics let's say from the Path Monitoring profile.
Currently, the customer's MPLS provider gives them statics like Jitter, Latency, etc.., and they would like to do more of an apples-to-apples comparison.
The data I need is in the SDWAN plugin itself and is available for export to a report. Just wondering if there are any other ways to get that data out of Panorama that's more "live".
Thanks in advance for your thoughts and assistance..
... View more
- Tags:
- panorama
- securesdwan
10-07-2021
12:35 PM
I'm still having this issue. I have created a folder and applied the same ownership properties as /PALogs. When I enter the new folder name and click the "save" button it appears to be fine. But if I navigate away from the setting page and come back there is no setting. Is there a configuration file where I can set the manually under the hood?
Was there ever a resolution?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-11-2022
07:02 PM
|
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks
