Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
- Panorama
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- CN-Series
- VM-Series:
- Private Cloud
- OCI
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
- Cortex Xpanse
Security Operations
- Resources
- COVID-19 Response Center
About johnwalshaw
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About johnwalshaw
12-23-2021
10Posts
1Like
0Solutions
Dec 23, 2021Last Visited
User
Activity
User
Profile
Latest posts by johnwalshaw
| Subject | Views | Posted |
|---|---|---|
| 66 | 11-29-2021 10:56 AM | |
| 426 | 11-26-2021 07:45 AM | |
| 440 | 11-26-2021 06:31 AM | |
| 130 | 11-25-2021 02:57 PM | |
| 500 | 11-25-2021 02:47 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 11-21-2021 11:36 AM |
User Badges
Community Statistics
| Member Since | 04-15-2020 04:54 AM |
| Date Last Visited | 12-23-2021 02:49 PM |
| Posts | 10 |
| Total Likes Received | 1 |
11-29-2021
10:56 AM
How do you have path monitoring configured? Maybe post a screenshot similar to what I posted?
... View more
11-26-2021
07:45 AM
Also, forgot to mention that I have each ISP on a separate virtual router, therefore there is no backdoor zero route possibility via another ISP link. The result is that path monitoring to specified internet destinations is working without fault.
... View more
11-26-2021
06:31 AM
I'm re-reading the thread and love that you have a script to harvest the gateway IP from the DHCP interface. The issue of your lease expiring is interesting as that should renew at the lease half-life. That is the problem I would perhaps think about. The process to trigger (schedule) the lease renew might be worth looking at. But is this an ISP issue at the core also? Regarding what the target is that you ping, there might be an opportunity there. Here is my config as feel it is representative of the internet.
... View more
11-25-2021
02:57 PM
I have tested DNS proxy on Palo and it worked great. I have not investigated the log detail.
... View more
11-25-2021
02:47 PM
For the DHCP interface you should uncheck the option to auto create default route. This is because the static route monitoring is for a static route, not for an auto generated route. Therefore, once you uncheck the option to auto create default route for DHCP interface, you need to create a static route to the ISP gateway IP. Only issue is that if the ISP ever change the gateway IP, your static route would become invalid.
... View more
11-25-2021
02:42 PM
I literally just configured this. I have the default virtual router and then a separate virtual router for each ISP (hub and spoke). With this method, you can prevent the dedicated ISP virtual routers having a zero route to the other ISP. Therefore path monitoring will have the desired effect to flush the zero route for that specific ISP. You need to create a loopback on each virtual router. Then create static routes (hub and spoke) to each ISP router (requires loopback). You can then configure eBGP on those links, along with redistribute. The method I used was local pref on the internal (default) virtual router to designate primary and secondary ISP. The failover is tuned to 3 seconds and then hold time of 2 minutes for fail back. PDF with screenshot can be found here, although this is not a how-to guide, it will give you some of the main concepts. https://www.linkedin.com/feed/update/urn:li:activity:6869729830720688128/
... View more
11-25-2021
02:33 PM
Keep in mind that DHCP is a conversation that happens before there is an IP address assigned, so the concept of a session might be different. I have not tested this on Palo myself. Maybe add both zones on the source and dest. My experience was Cisco ISR ACL and that was quite interesting. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFXCA0
... View more
11-25-2021
01:55 PM
Something else to keep in mind is that VM-50 is fully licensed, so if you go for lower throughput, there are more options out of the box.
... View more
11-25-2021
01:52 PM
Agreed and understood. I updated my original post. I have tested DDNS successfully now. Seems like a weird method considering there is a default CA store, which is inexplicably unavailable for a public internet public CA URL.
... View more
11-21-2021
11:36 AM
1 Kudo
I originally tested without Cert Profile, thinking that PAN would use the the default Internet CA store, but this is not an option. You literally need to download and install the root CA (and intermediate) on PAN, which I think defeats the purpose of PAN-OS having a default CA store. Once you have installed the root CA, then create a cert profile and add the root CA (and intermediate if applicable). I called it cert_profile_1 as I assume I would add more root CAs for other things in the future. You do not need to add the web site cert. So all should be good unless the web site changes to a different root CA. It would be great if PA has the option to 'use default cert store' instead of an explicit cert profile.
... View more
LEGAL NOTICES
Copyright 2007 - 2022 - Palo Alto Networks
