About SebRupik

Hi there, If you are talking about adminstator accounts on the firewall, have you considered creating custom Role Based profiles and assigning them to the local accounts? https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/firewall-administration/reference-web-interface-administrator-access/web-interface-access-privileges/define-access-to-the-web-interface-tabs.html   cheers, Seb. ... View more

Hi there, The only cli command that I know of is  tail follow yes mp - log routed .log which may provide some extra details.   Are your peers iBGP or eBGP? Do the routes appear in the RIB-out table? Do they appear in the peer BGP local RIB but not the forwarding table?   cheers, Seb. ... View more

Hi there, You cannot create L2VPN on the Palo Alto. The document referenced by @asangra shows a PA in L2 mode, but the IPSec tunnel created is between a router and L3 mode PA. The encapsulated tunnel is Layer 3.   If you wanted to create a L2VPN you would need to do it between two routers.   Regarding which is better, it is dependent on the traffic type. Some network services operate at Layer2 only and cannot be routed, so an L2VPN between sites is the only viable option. From a security perspective as you have seen, the PA can operate in either mode to provide security.   cheers, Seb. ... View more

Hi there, Take a look at this document: https://www.paloaltonetworks.com/resources/guides/azure-transit-vnet-deployment-guide ... Page 127 - Deployment Details for a Backhaul Connection   cheers, Seb. ... View more

Hi there, You can export and load the device state if you wanted. The device state bundle will be a larger file and contain extraneous data not required by a 'normal backup' if the type of firewall deployment does not require it.   cheers, Seb. ... View more

Hi there, If you just want to duplicate the configuration of a firewall then loading just the exported running configuration (or latest named) onto a firewall of the same platform and software version is the way to go. Using a state export/import is required when restoring a FW running a GlobalProtect Portal.   cheers, Seb. ... View more

Yes, if the FWs are not connected on the same L3 link between the DCs, then if using eBGP, multi-hop will need to be configured (remember iBGP doesn't require multi-hop. Do your DCs really need to be seperate autonomous systems?). Is the L3 network between the DCs for you exclusive use or is it at all shared? If the latter, then it would be advisable to create an IPSec tunnel between them for security purposes.   cheers, Seb. ... View more

Hi there, What route is being advertised via the VPN tunnels, is it the same destination prefix, for example a default route 0/0 ? If so, you can configure ECMP on the VR within which these three VPN tunnels are routed. You will need the change the ECMP Max Path from the default value (2) to 3. It sounds like you will be wanting to use the WRR algorithm for load distribution: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/networking/ecmp/ecmp-load-balancing-algorithms.html   cheers, Seb. ... View more

Hi there, Creating an IPsec tunnel and forming an eBGP adjacency between the tunnel endpoints is an easy design to implement. Do you have any further topology requirements we can work with?   cheers, Seb. ... View more

Hi there, you cannot create an equivalent prefix-list / route-map combination in PANOS. Your best option would be to tag the host routes with a particular community string and use an import policy on the firewall to deny those prefixes.   ! ip prefix-list FOO-OUT seq 10 permit 0.0.0.0/0 ge 32 ! route-map PA01 permit 10 match ip address prefix-list FOO-OUT set community 65000:999 ! route-map PA01 permit 20 set community 65000:1 ! router bgp 65000 bgp log-neighbor-changes neighbor 192.168.100.1 remote-as 65001 ! address-family ipv4 network 100.0.0.1 mask 255.255.255.255 network 192.168.101.0 mask 255.255.255.252 neighbor 192.168.100.1 activate neighbor 192.168.100.1 send-community neighbor 192.168.100.1 route-map PA01 out exit-address-family !   Now under normal circumstances we can see both prefixes on the Palo, with the different community strings: admin@PA-VM> show routing protocol bgp loc-rib-detail VIRTUAL ROUTER: WAN (id 2) ========== ---------- Prefix: 100.0.0.1/32 * Nexthop: 192.168.100.2 Received from: Peer ISP01 (id 1) Originator ID: 0.0.0.0 AS Path: 65000 Origin: IGP MED: 0 Local Preference: 100 Atomic aggregate: no Aggregator AS: 0 Aggregator ID: 0.0.0.0 Weight: 0 Flap: value 0.00, count 0 Community: 65000:999 ---------- Prefix: 192.168.101.0/30 * Nexthop: 192.168.100.2 Received from: Peer ISP01 (id 1) Originator ID: 0.0.0.0 AS Path: 65000 Origin: IGP MED: 0 Local Preference: 100 Atomic aggregate: no Aggregator AS: 0 Aggregator ID: 0.0.0.0 Weight: 0 Flap: value 0.00, count 0 Community: 65000:1   So now we create an import policy, two parts, first to drop prefixes with community 65000:999 and the second to allow everything else: set network virtual-router WAN protocol bgp policy import rules drop_65000_999 action deny set network virtual-router WAN protocol bgp policy import rules drop_65000_999 match community regex 65000.999 set network virtual-router WAN protocol bgp policy import rules drop_65000_999 match route-table unicast set network virtual-router WAN protocol bgp policy import rules drop_65000_999 used-by ISP set network virtual-router WAN protocol bgp policy import rules drop_65000_999 enable yes set network virtual-router WAN protocol bgp policy import rules everything_else action allow update as-path none set network virtual-router WAN protocol bgp policy import rules everything_else action allow update community none set network virtual-router WAN protocol bgp policy import rules everything_else action allow update extended-community none set network virtual-router WAN protocol bgp policy import rules everything_else match route-table unicast set network virtual-router WAN protocol bgp policy import rules everything_else used-by ISP set network virtual-router WAN protocol bgp policy import rules everything_else enable yes   Commit the config and check to the local RIB: admin@PA-VM> show routing protocol bgp loc-rib-detail VIRTUAL ROUTER: WAN (id 2) ========== ---------- Prefix: 192.168.101.0/30 * Nexthop: 192.168.100.2 Received from: Peer ISP01 (id 1) Originator ID: 0.0.0.0 AS Path: 65000 Origin: IGP MED: 0 Local Preference: 100 Atomic aggregate: no Aggregator AS: 0 Aggregator ID: 0.0.0.0 Weight: 0 Flap: value 0.00, count 0 Community: 65000:1   Hope that helps.   cheers, Seb.     ... View more

Hi there, If I understand you correctly, once on the cli enter the commands: configure commit   Any policy you want to create will be done once in configuration mode via set commands, although it is a bit of a minefield if you've not used it before!   Once you've logged onto the CLI run the command: set cli config-output-format set The go into configure, and issue the command show .... this will display the entire config in set format and give you a good idea how to create/ update policy on the firewall. You can search the configuration with the command show | match foo where foo should be replaced with the string you are looking for.   cheers, Seb. ... View more