About Kevin.lane

We are actually seeing similar behaviour on Pan 6.1.2 on our PA-3020's. We try to sync from the primary to the secondary and it fails with that same error.  It has caused us no end of problems because effectively, the only way for us to get the sync to work is remove the global protect configuration which makes use of the certificates and then delete the certificates.  I'm wondering if anyone else has seen this and has an idea of why it may be happening? ... View more

You mention that there is work in progress to provide further options for reject. I didn't see anything specific mentioned in the 6.0 release notes. Can you tell me whether there have been any improvements upon this?  We also require the ability to set a specific reject for a particular policy.  We'd like to let some things remain drop, but for specific subnets that we still want to block, we'd like to do a reject. ... View more

I'm not sure if this is helpful or not, but one of our other DHCP issues we run into is due to the route to the DHCP server being dropped. Example: On the PA, we have zone X which provides services to a particular set of clients. We then have zone Y which connects the main part of our network, including the DHCP server.  Zone X router does a DHCP relay to the DHCP server through the PA.  This works fine normally.  However, sometimes, the switch between the PA and the router controlling our main network reboots. When that happens, our DHCP from zone X begins failing. Going into session browser on the PA shows that because the route to the DHCP server was lost when the PA dropped its OSPF connection to the main network router, the DHCP requests started being sent to the "Outside" zone and essentially the session just locks.  When I delete that session, it starts going back the proper way and DHCP begins working again. It may be completely unrelated, but the session browser might be a good place to see anything odd happening. Regards Kevin ... View more

Hi, We ran into this problem as well when we were running Active-Active HA.  When one is Suspended, it works fine.  Do you by any chance run your setup that way? Regards, Kevin ... View more