About twhite

Over three hours on the phone to PA support this morning got it sorted. My applictation override rules were not working, as they were pointing at predefined applications.  Custom Apps for both SIP and RTP were created which then started to allow some RTP through. We were still getting quite a few calls with no audio (some were coming through).  The PA engineer discovered that this was due to us using the dynamic-ip-and-port option in our outgoing source translation.  Changing this to static-ip fixed it. Here's what my working setup looks like; Security Rules; NAT Rules; Application Override Rules; Custom SIP Application; Custom RTP/RTCP Application; Hope this helps anybody experiencing similar problems.  PA have taken a support dump, so may have a more elegant fix at some point. ... View more

Hello, I believe any SMTP server should work. I've recently set this up in my lab with a basic SMTP Ubuntu install and it works fine. In the service route configuration, have you left emails to go out the default (management interface)? If so, can the management interface communicate to the email server via ping or telnet to port 25? You can look in the ms.log for information or errors pertaining to failed emails. This may give us more clues as to why it's failing. > tail follow yes lines 25 mp-log ms.log Then run the test again, and look to see if any errors are showing. Thanks, Jason Seals ... View more

I documented the IPSec configuration between Palo Alto F/W and Watchguard's while running version PAN-OS 2.0.  The configuration should work with later OS release.  Please use this as a reference. ... View more

See response on this thread for command to see all limits (https://live.paloaltonetworks.com/message/1686#1686). We do have an internal doc and will take a look at how to best disseminate this information. Mike ... View more

Hi Mike, I have a same scenario with the 5000 platform. Can you please give me the details for the limitations: Error: Number of dynamic-ip-and-port rules (401) exceeds vsys capacity (400) I see the command above gives us a general perception of max limitations on box. For NAT this is what I see, cfg.general.max-nat-policy-rule Thanks Samshodh ... View more