About bwmillslg

Good thing I only have 1 Mac user that needs remote access, then!  We're using VNC as a workaround, I wonder if there is an IPSec method to connect him? ... View more

"Basically, if you put in an address of 12.x.x.1/27, for example, on an external interface of the pan, that means that we are going to be listenting for all of the IPs in that range (27 bit mask = 30 addresses). " Ah, that makes more sense.  In our current configuration, we use a small handful of that 30 address range to NAT individual websites and domains that we serve to the Internet.  Multiple sites under multiple domains.  The existing firewall requires each public address to be entered as a secondary on the external interface before you can put it in the NAT table.  I'll have to look at your suggestions on the NAT policy in the PA-500.  It seems that my preconceptions from previous firewalls are leading me astray when it comes to these new (and *better!*) ways of doing the same things. Thanks for your help! ... View more

It would seem that as I continue my research, I'm finding that the subinterfaces require VLAN tags.  I'm not certain how this will affect my traffic on the internal network.  I have some VLANs, but I wasn't planning to create new ones to accomodate the incoming traffic.  In my current firewall, I just add a list of secondary IP addresses and go about the business of NAT'ing those to other LAN addresses.  Maybe I should be looking at it another way? ... View more

That makes so much more sense, thank you!  I was under the impression that the agent ran on every user's desktop.  It's even better than I thought!  :smileygrin: ... View more