About Metgatz

Best option HA Palo Alto AWS - VPN Site to Site - Full fail over no balancing   Hello, how are you doing, I hope you are well.   In your experience, those who are clear about it and those who are not, what is the best way to implement an HA in AWS? I understand that for full Native HA from Palo Alto, it can be done in two ways according to a Palo Alto article, where the configurations are synchronized by the HA, but there is the limitation of the same availability zone.   Now when it is in different AZ of AWS you cannot use the native HA and you have to rely on a balancer and if you do not want to do the config manually you must have a Panorama.   We have in summary for both:   Case 1: same AZ of aws, Mandatory Balancer and native HA, without the need for Panorama.   Case 2:   different AZ from aws, balancer mandatory, not native HA, recommended use of Panorama.   According to your experience, considering that they will be used for Site to Site VPN, therefore it must be Full Fail over mode at the Balancing level, what is the best recommendation to love the HA of Palo Alto on AWS? With which have you had the best results?   Stay tuned   Thank you for your time, collaboration, good vibes   Greetings ... View more

Hello Live Community, how's it going, I hope it's going well.   One question, I have the following doubt.   Soon I have to generate a Site to Site VPN connection, between a Palo Alto On-prem and another Palo Alto that is in AWS. I understand that the Palo Alto on the AWS side, the Palo Alto does not have a direct public IP on the interface, therefore there is a mapping that AWS does between the Public IP and the private IP of the public network that they call. I understand that this is like a 1:1 DNAT/NAT that aws then does with the resource to the Palo Alto untrust on AWS.   Now my doubt, that means that the configuration at the time of making the tunnel between the PA of On-Prem that has a public IP directly in its WAN/Untrus Interface, with the Palo Alto in AWS, must be configured as if they did it with a computer that is behind a nat ? that is to say to use Nat-traversal ? Firewall01 Onprime ----IP Public IP Untrust Interface -----------I---0nternet-------------IPSEC VPN-------------AWS Public IP---------- Mapping Public IP to Private IP of the PA on AWS------ IP/Interface Untrust PA On AWS   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClopCAC     Traversal is supposed to apply when you are behind a NAT but... when we understand that the 500-UDP arrives to that edge device, what does the NAT do, therefore NAT traversal will forward the UDP 4500 to the internal device, but in this case you have an example where no NAT-Traversal was used at either end, with one end at AWS and it operates without problems, without using NAT-Traversal. But if as you say using Peer Identification and Local Identification. Now I have great confusion, because I see that in this Link, in the step by step, they do not enable NAT-T and it works perfectly, that is why now I have a great doubt regarding NAT 1:1 or the Mapping that AWS does. Because here I see that they do not enable it and it works perfectly.   This Link AWS Palo Alto Site to Site VPN:   https://tungle.ca/?p=4089   So it should be configured similar to this, right? As against a NAT Traversal ?   Has anyone had experience configuring VPN IPSEC, against Palo Alto in AWS ?   Thanks in advance for your time, good vibes and cooperation as always.   I remain attentive, best regards ... View more

Hello Live Community , good evening, how are you, I hope you are very well.   I have a question that I would like you to confirm and comment on please. Thank you for your collaboration and for your good vibes.   In a VWire Active-Passive HA environment, where this topology exists.   Firewall-01 on VWire Active ----- Firewall-02 on VWire Passive Interfaces 1/1 and 1/2 Vwire-01 Firewall-01 Priority 50 Firewall-02 Priority 100 Preemtive enabled on both computers. Preemtive Hold time: 1 Minute ( Default value ). Passive Link State: Shutdown Vwire: Link-State-Pass-Through enable ( Default ). Link monitor on both firewalls: Firewall-01: Ethernet 1/1 and 1/2 - ANY Interface Firewall-02: Ethernet 1/1 and 1/2 - ANY Interface   Failure Scenario:   In the event of a failure in the Firewall-01 Ethernet 1/1 and 1/2 interface. Firewall-02 will assume the role of Active.   If Firewall-01 recovers from its failure in its Ethernet interfaces 1/1 and 1/2, Firewall-02 of the secondary block (with the Role of Active) will wait 1 minute (Preemtive Hold Time 1 minute) to redeliver the Active Role to Firewall-01 to the main block.   Or for this to work, should the secondary be in Passive Link Auto so that it is negotiating and not in Passive Link Shutdown? This is because I have a doubt, since how is it going to detect the Palo Alto that recovered from its failure condition, from the link monitor, if it has its interfaces down, they should be on auto, right?   In HA VWire environment I'm not entirely familiar versus L3 environments.   Com VWire according to what I comment, especially in the scenario of failure and recovery of the Principal, is this expected behavior correct? or with VWire is it different? should assume or validate other additional details, regarding HA issues, such as Timers, settings, options, etc.   Thank you in advance for your time, for your good vibes, for your collaboration, advice and comments.   Greetings ... View more

Hello Live Community, good evening, thanks a lot for your time and colaboration.   I have a question regarding the value of "HA timer - Additional Master Hold Up Time" by default is 500 ms. In the documentation it indicates that this is an additional value to the "Monitor Fail Hold Up Time (ms)" that is to say, how many examples are an Interface being monitored, example at Link monitor level, example 1/19 or 1/20 by default It is at 0, that is, it will not wait long.   However, now I have my doubt, for the value "HA timer - Additional Master Hold Up Time" which is 500ms by default, this value will be added in case I configure something other than 0 in the Monitor Fail Hold Up Time (ms ) ? Or will it always be those 500 ms plus 0, that is, will it always wait for 500 ms? or those 500ms are added to the wait only in cases where I have made an adjustment to the value 0, that is, for example if:   If I configure Monitor Fail Hold Up Time (ms): 300 ms + will be added to the 500 ms of the "HA timer - Additional Master Hold Up Time", that is, 800 ms. But if I don't configure anything, that is to say 0, by default in Monitor Fail Hold Up Time (ms): 0 ms (default) will the 500 ms of the "HA timer - Additional Master Hold Up Time" be added or not? I am wondering if the 500 ms are added when I adjust the Monitor Fail Hold Up Time (ms ) from its default value, the 500 ms are just added there or there are always those 500 ms when an interface crash is triggered. Is it monitoring or does a flaping happen, that is, it is always those 500 ms, yes or no?   I review the documentation, however it is still not clear to me.   https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/high-availability/ha-concepts/ha-timers#:~:text=Monitor%20Fail%20Hold%20Up%20Time%20(ms)     Thank you everyone for your time, good vibes, comments,collaboration and advices.    Best regards ... View more

How and when to use ARP-Loadsharing and Floating IP - Upstream/Uplinks Hello Live comunity, how are you all doing. In the use cases you can see that the use of ARP Load-sharing or IP Floating, ARP is used thinking in the access to the Gateway vs IP Floating that is something more like fail-over more like an active/passive so to speak, than ARP Load-sharing that distributes vs Ip floating that acts as fail over.   -Why wouldn't you use ARP Loadsharing or when would you use it thinking purely in Upstream/Uplinks? -I was thinking in cases where the external/IP or Uplinks/Upstream interface of the HA Firewall, is a route of some router or superior device, that points to the HA IP, ARP-Load sharing, could in this case point to an ARP Loadsharing IP as well or not ? -Now thinking about if it is a totally edge firewall, perimeter, where it has DNAT, and so on, maybe there we have limitations of using ARP loadsharing vs IP Flaoting.   If someone has already worked too much with HA Active/Active firewall or has mastered very well the theory and concepts regarding the use in Uplinks/Upstream, where to use ARP-Loadsharing / IP Floating. Or anyone who wants to add their comments.   Thank you very much for your time, your collaboration and your comments. Best regards ... View more

Open Source SNMP Network Monitor Server - Palo Alto Firewalls Next Gen   Hello good afternoon live community. As always thanks for your time and collaboration.   According to your experience, which are the best alternatives to implement a monitoring server based on SNMP for Palo Alto firewall ? Which are Open Source or open source and have great compatibility with models 220, 32XX, 52XX, and even the latest hardware models. Which one(s) do you recommend that are not too complex and time consuming to implement and not too much overhead.   Thanks   I remain attentive   Best regards ... View more

Hello good evening Live Community, as always thanks for the collaboration and your time.   Any of you have had to do the following:   Detail Environment/infra: HA 5220 x 8 connected to Panorama with Device Groups and Template Stack.   What are you looking to validate and be able to do, generate new Virtual Systems for new traffic on these HA machines that are already productive connected to Panorama.   Per license with the base of 10 vsys is enough. Now, have any of you had to deal with something like this? i.e. firewall in HA, connected to Panorama, deploying vsys on them?   Does it involve reboots? Does it involve situations or limitations with Panorama and the vsys ? will it be transparent for the current Tempalte and Device Groups ? Is it necessary to do onboarding of the new vsys ? What are the major issues to review, validate and take special care for this environment?   These firewalls have a usage of 5 to 10% with luck, so they want to take advantage of the interfaces that are left over and take advantage of the hardware to use vysys and have another 2 or 3 firewalls for each HA.   Thank you very much for your comments, tips, details, help, recommendations and above all for your time and good vibes.   I remain attentive   Best regards ... View more

Hello Live Community, good afternoon, thanks for your time and comments.   About automating and anticipating some possible blockages and denials using Dynamic Groups - Autotag can you support me and comment me with some use cases ?   Also, if you have implemented it, has it brought you good results ? does it work as expected ? what is the main thing to keep in mind when implementing it ?   Thanks everyone    I remain attentive   Best regards ... View more