This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
Accept
Reject

About NathanielM

cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
NathanielM
‎11-22-2022
since ‎01-07-2021
L1 Bithead
User Activity
User Profile
User Badges
Community Statistics
Member Since ‎01-07-2021 02:33 AM
Date Last Visited ‎11-22-2022 04:54 AM
Posts 11

Re: HA on AWS Using a Secondary IP

by in VM-Series in the Public Cloud
‎08-19-2022 07:07 AM
‎08-19-2022 07:07 AM
TAC resolved this for me, it was the  dpdk settings for anyone else facing the same issue.    Interestingly the guide for "interface move" ha mode explains this needs to be turned off but not the "secondary IP" guide.   Before: PA-VM(active)> show system setting dpdk-pkt-io Device current Packet IO mode: DPDK Device DPDK Packet IO capable: yes Device default Packet IO mode: DPDK     After: PA-VM(active)> show system setting dpdk-pkt-io Device current Packet IO mode: Packet MMAP Device DPDK Packet IO capable: yes Device default Packet IO mode: Packet MMAP   Here is a good explanation of DPDK: https://docs.paloaltonetworks.com/plugins/vm-series-and-panorama-plugins-release-notes/vm-series-plugin/vm-series-plugin-20/vm-series-plugin-201/whats-new-in-vm-series-plugin-201   I think it was off by default until recently hence the guide may be out of date. ... View more

HA on AWS Using a Secondary IP

by in VM-Series in the Public Cloud
‎08-03-2022 02:41 AM
‎08-03-2022 02:41 AM
Hi,   Just checking if anyone has successfully deployed the latest HA mode "secondary-ip". Unfotunately the deployment guides can be described more as "guides" rather than detailed instructions. Furthermore they are fragmented so one has to scramble over different places and review pages, sometimes unrelated to the new mode  😅 .   Anyway my issue is HA is up and running, and I presume in a ready state due to the CLI output. In fact I am even able to suspend a device and the other assumes the active role. However the big issue is that the actual "vm_series" plugin for AWS magic does not happen: No secondary IPs move over to the passive device. Route tables do not change to the ENI of the passive device. I have tried with plugin 2.1.5 and 2.1.7 and it is the same behaviour. PAN-OS 10.1.5-h2, VM-300, m5.xlarge, eu-west-1.   Anyone have any tips?   By the way, what wasn't specified in the guides is that the management interface needs Internet access in order to run some of the "show plugin" commands.   Topology   💡 The test instance can reach the Internet through the active firewall which performs source NAT to the secondary IP.   Active:     PA-VM(active)> show plugins vm_series aws ha failover-mode HA failover mode: secondary-ip PA-VM(active)> show plugins vm_series aws ha state Type Active Passive Status ====================================================================================================================================================== INTERFACES 0: eni-0721c7f1fd0d6d5c3 0: eni-0118f5b32a378a738 Pass 1: eni-09f1b2f0bb79ceb93 1: eni-0b4aa2715fe380995 2: eni-0440268dd0a05e96c 2: eni-0188d3f804ea62a23 3: eni-00b98967a33415e66 3: eni-0e41883adf46de89d ______________________________________________________________________________________________________________________________________________________ IAM_POLICY_PERMISSIONS ec2:AttachNetworkInterface ec2:AttachNetworkInterface Pass ec2:DetachNetworkInterface ec2:DetachNetworkInterface ec2:DescribeInstances ec2:DescribeInstances ec2:DescribeNetworkInterfaces ec2:DescribeNetworkInterfaces ec2:AssignPrivateIpAddresses ec2:AssignPrivateIpAddresses ec2:AssociateAddress ec2:AssociateAddress ec2:DescribeRouteTables ec2:DescribeRouteTables ec2:ReplaceRoute ec2:ReplaceRoute ______________________________________________________________________________________________________________________________________________________ INSTANCE_ID i-022250b4dd95b5d60 i-079b89223e9372e15 - ______________________________________________________________________________________________________________________________________________________ HA_FAILOVER_MODE secondary-ip secondary-ip Pass ______________________________________________________________________________________________________________________________________________________ IAM_POLICY_NAMES single-az-vpn-labs-fw-ha_interface-swap_route-edit-profile single-az-vpn-labs-fw-ha_interface-swap_route-edit-profile- ______________________________________________________________________________________________________________________________________________________ IAM_ROLE single-az-vpn-labs-fw-ha_interface-swap_route-edit-role single-az-vpn-labs-fw-ha_interface-swap_route-edit-role- ______________________________________________________________________________________________________________________________________________________ PA-VM(active)> show plugins vm_series aws ha ips Interface Eni-Id PrimaryIP:PublicIP SecondaryIP:PublicIP ======================================================================================================================== Management eni-0721c7f1fd0d6d5c3 10.65.48.10: ------------------------------------------------------------------------------------------------------------------------ Ethernet1/1 eni-09f1b2f0bb79ceb93 10.65.48.40: ------------------------------------------------------------------------------------------------------------------------ Ethernet1/2 eni-0440268dd0a05e96c 10.65.48.75: 10.65.48.74:3.248.70.122 ------------------------------------------------------------------------------------------------------------------------ Ethernet1/3 eni-00b98967a33415e66 10.65.48.139: 10.65.48.138: ------------------------------------------------------------------------------------------------------------------------ PA-VM(active)>       Passive:       PA-VM(passive)> show plugins vm_series aws ha failover-mode HA failover mode: secondary-ip PA-VM(passive)> show plugins vm_series aws ha state Type Active Passive Status ====================================================================================================================================================== INTERFACES 0: eni-0118f5b32a378a738 0: eni-0721c7f1fd0d6d5c3 Pass 1: eni-0b4aa2715fe380995 1: eni-09f1b2f0bb79ceb93 2: eni-0188d3f804ea62a23 2: eni-0440268dd0a05e96c 3: eni-0e41883adf46de89d 3: eni-00b98967a33415e66 ______________________________________________________________________________________________________________________________________________________ IAM_POLICY_PERMISSIONS ec2:AttachNetworkInterface ec2:AttachNetworkInterface Pass ec2:DetachNetworkInterface ec2:DetachNetworkInterface ec2:DescribeInstances ec2:DescribeInstances ec2:DescribeNetworkInterfaces ec2:DescribeNetworkInterfaces ec2:AssignPrivateIpAddresses ec2:AssignPrivateIpAddresses ec2:AssociateAddress ec2:AssociateAddress ec2:DescribeRouteTables ec2:DescribeRouteTables ec2:ReplaceRoute ec2:ReplaceRoute ______________________________________________________________________________________________________________________________________________________ INSTANCE_ID i-079b89223e9372e15 i-022250b4dd95b5d60 - ______________________________________________________________________________________________________________________________________________________ HA_FAILOVER_MODE secondary-ip secondary-ip Pass ______________________________________________________________________________________________________________________________________________________ IAM_POLICY_NAMES single-az-vpn-labs-fw-ha_interface-swap_route-edit-profile single-az-vpn-labs-fw-ha_interface-swap_route-edit-profile- ______________________________________________________________________________________________________________________________________________________ IAM_ROLE single-az-vpn-labs-fw-ha_interface-swap_route-edit-role single-az-vpn-labs-fw-ha_interface-swap_route-edit-role- ______________________________________________________________________________________________________________________________________________________ PA-VM(passive)> show plugins vm_series aws ha ips Interface Eni-Id PrimaryIP:PublicIP SecondaryIP:PublicIP ======================================================================================================================== Management eni-0118f5b32a378a738 10.65.48.11: ------------------------------------------------------------------------------------------------------------------------ Ethernet1/1 eni-0b4aa2715fe380995 10.65.48.41: ------------------------------------------------------------------------------------------------------------------------ Ethernet1/2 eni-0188d3f804ea62a23 10.65.48.76: ------------------------------------------------------------------------------------------------------------------------ Ethernet1/3 eni-0e41883adf46de89d 10.65.48.140: ------------------------------------------------------------------------------------------------------------------------ PA-VM(passive)>     ... View more

Re: AWS Tunnels Down when We make a Failover

by in General Topics
‎08-03-2022 02:20 AM
‎08-03-2022 02:20 AM
Not sure if you found a solution to this...   As stated here in the KB article: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVGCA0 My interpretation of reading that means if the tunnel goes down (or presumably being initially set up) it will only be negotiated by interesting traffic, so you have several options to keep that interesting traffic:   Tunnel monitor using your tunnel interface, the route to the peer will be via the tunnel hence it is interesting traffic (icmp between tunnel peers on the same /30 subnet). On a side note i'd use "path monitoring" instead of PBF if you have two static routes to the same destination. E.g. 10.1.0.0/24 via tunnel 1, 10.1.0.0/24 via tunnel 2. Just put the prefferred metric on 10 and the other 20 and be sure to path monitor on both routes. If you have a monitoring tool such as Solarwinds ping something on the remote end, even if it is just to a dummy host, this will be icmp to the remote end. Set up a lambda function to be triggered when the tunnel is down. It will then run the "test" commands on the PA: test vpn ike-sa gateway <gateway_name> test vpn ipsec-sa tunnel <tunnel_name> https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/vpns/set-up-site-to-site-vpn/test-vpn-connectivity ... View more

Re: AWS S2S VPNs not re-establishing?

by in General Topics
‎08-03-2022 02:15 AM
‎08-03-2022 02:15 AM
Not sure if you found a solution to this...   As stated here in the KB article: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVGCA0 My interpretation of reading that means if the tunnel goes down (or presumably being initially set up) it will only be negotiated by interesting traffic, so you have several options to keep that interesting traffic:   Tunnel monitor using your tunnel interface, the route to the peer will be via the tunnel hence it is interesting traffic. On a side note i'd use "path monitoring" instead of PBF if you have two static routes to the same destination. E.g. 10.1.0.0/24 via tunnel 1, 10.1.0.0/24 via tunnel 2. Just put the prefferred metric on 10 and the other 20 and be sure to path monitor on both routes. If you have a monitoring tool such as Solarwinds ping something on the remote end, even if it is just to a dummy host. Set up a lambda function to be triggered when the tunnel is down. It will then run the "test" commands on the PA: test vpn ike-sa gateway <gateway_name> test vpn ipsec-sa tunnel <tunnel_name> https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/vpns/set-up-site-to-site-vpn/test-vpn-connectivity ... View more

Netmiko output blank

by in Automation/API Discussions
‎07-19-2022 02:34 AM
‎07-19-2022 02:34 AM
Hi,   I run Netmiko for bulk packet captures in AWS. It works well but there is never output when using the Palo Alto device type. Output for Cisco works well. An example would be:   from netmiko import ConnectHandler print("Connecting to Palo Alto to show clock") virtual_palo = { 'device_type': 'paloalto_panos', 'host': '192.168.1.100', 'username': 'automationadmin', 'password': 'ciscothenpalo123', } net_connect = ConnectHandler(**virtual_palo) output = net_connect.send_command('show clock') print(output) print("Connecting to Cisco Switch to show clock") cisco_switch = { 'device_type': 'cisco_ios', 'host': '192.168.1.101', 'username': 'automationadmin', 'password': 'ciscothenpalo123', } net_connect = ConnectHandler(**cisco_switch) output = net_connect.send_command('show clock') print(output) This is just an example by the way, I don't run the scripts to show the clock, nor are those my credentials etc :-). The output would be:   python3 test_script.py Connecting to Palo Alto to show clock Connecting to Cisco Switch to show clock 10:18:46.830 BST Tue Jul 19 2022 You see the issue. By the way this is my Netmiko version: pip show netmiko Name: netmiko Version: 4.1.1 Summary: Multi-vendor library to simplify legacy CLI connections to network devices Home-page: https://github.com/ktbyers/netmiko Author: Kirk Byers Author-email: ktbyers@twb-tech.com License: MIT Location: /usr/local/lib/python3.9/site-packages Requires: ntc-templates, paramiko, pyserial, pyyaml, scp, setuptools, tenacity, textfsm Required-by:   PAN-OS: vm-license: VM-100 vm-cap-tier: 6.5 GB vm-cpu-count: 2 vm-memory: 7857036 vm-mode: Amazon AWS cloud-mode: cloud sw-version: 10.1.5-h1   Any help would be great thanks. ... View more
Register or Sign-in
Contact Me
Online Status
Offline
Date Last Visited
‎11-22-2022 04:54 AM
Likes Given To
LEGAL NOTICES
RESOURCES
Copyright 2007 - 2023 - Palo Alto Networks