About pankaku

Hello @ArnljotSeem, Unfortunately this thread is now 2 years old, so I cannot recall what the root cause was. Based on your problem description so far though, I'm inclined to say that the issue behind it is not the same one. You're saying that other VPN s2s solutions work, and this is specific to the PA and StrongSwan. I'd check release notes for any later StrongSwan versions, and/or try a different FOSS IPSec solutions, if at all possible. This message sounds hopelessly generic, but I'd at least wanted to let you know I didn't have the answer you were seeking for anyway 😕 ... View more

Can you provide details of what you are trying to accomplish?   I use bi-directional NAT rules to redirect different internal subnets to specific ranges of public IP addresses.   I do not bind any NAT rules to interfaces, but rather zones. ... View more

Hi, For example if the topology like below , Is it enough to mark the qos only on PA  or does it required to mark on other  routers ,switch and asa( nating happening here) . PA Is in vwire mode    topology   Thanks   ... View more

Thats a very good point, I just wish I could find the information that suggested it ... View more

I've seen the same issue on some cases after the PA-200 upgraded to PAN-OS 7.1.1.   In those cases the device was also experiencing other issues. Are you still able to log into the web-GUI ? Is the device still passing traffic normally ?   Eitherway I recommend that you open a case with support to identify the root cause.   Regards, -Kim. ... View more

Hiya, Have you managed to get certificates working between ASA and Palo Alto? We are getting the following error messages. Thanks, Paul   2016-08-08 12:44:02 [PROTO_ERR]: RSA_verify failed: 4112512720:error:04091064:rsa routines:INT_RSA_VERIFY:algorithm mismatch:rsa_sign.c:269: 2016-08-08 12:44:02 [PROTO_ERR]: Invalid SIG. 2016-08-08 12:44:02 [PROTO_ERR]: 30779:y.y.y.y[500] - x.x.x.x[500]:0x8a44598:authentication failure ... View more

That sounds reasonable. Unfortunetely, it will be a little while before I can schedule a restart of the firewall. It has definetely been up for over a year. Again, it's not a huge problem since we only use it for monitoring, it's just an annoyance. Thanks for the advice. Once I'm able to do the restart I'll mark this the answer if it does indeed fix the problem. ... View more

Could you refresh with that command and paste the output of the command.   tail lines 100 mp-log ms.log ... View more

hey, I was able to get this one working with a simple copy and paste error when resolving the original error in the GUI with a CLI config instead ... View more

@pankaku Can you please hit Edit for the interface and check the settings? Do you see no vsys under Agg interface? Here is what I see. Though the interface screen shows none for vsys, if you edit the interface it has vsys associated. ... View more