This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About BDS_Vince
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About BDS_Vince
04-11-2019
14Posts
0Likes
0Solutions
Apr 11, 2019Last Visited
User
Activity
User
Profile
Latest posts by BDS_Vince
| Subject | Views | Posted |
|---|---|---|
| 1893 | 12-04-2018 01:21 PM | |
| 1904 | 12-04-2018 11:08 AM | |
| 9502 | 04-06-2016 11:13 AM | |
| 4910 | 03-17-2016 03:22 PM | |
| 5100 | 03-07-2016 11:34 AM |
User Badges
Community Statistics
| Member Since | 04-21-2015 09:24 AM |
| Date Last Visited | 04-11-2019 01:42 PM |
| Posts | 14 |
12-04-2018
01:21 PM
Thats's a good question.. I would assume the routes are in their forwarding table since I can use SNAT rules to direct traffic over each of the 6 IP addresses which I visually confirmed with showmyip.net. The response page wouldn't show if the route was missing. Inbound (DNAT) is being tested using the default IIS page with the system used in the outbound test. Requests to the default page time out. The security and NAT rules never increment. Both rules at the tops of their respective lists. The page displays when requested from systems on the local LAN.
... View more
12-04-2018
11:08 AM
We are opening a new branch office and recieved notice that the carrier will not be providing a router and that it was our responsibility to perform the WAN to LAN routing. The carrier provided a layer 3 WAN block and a Customer Useable block containing 6 IP addresses. If I configure ethernet 1/1 with the WAN block IP address I can send/receive traffic using that IP address, I can send traffic (snat) out the interface using one of the Customer IP addresses. The problem is that I can't receive (dnat) data from any of the customer IP addresses. The NAT and Security policies are not used (counters are not incrementing). I believe the problem is that I need to add a route from the WAN ip address for the 6 customer IP addresses. Can I use a static route or is this a case for 2 virtual routers? Routing is not my strong suit so any help will be greatly appreciated! TIA! Here is the the cutsheet data (randomized) WAN Link IP: 40.202.237.172/30 GW : 40.202.237.173 Layer 3 IP: : 40.202.237.174 Mask: 255.255.255.252 Customer useable address block Block: 50.206.224.144/29 Range: 50.206.224.145-50.206.224.150 Mask: 255.255.255.248
... View more
04-06-2016
11:13 AM
Is it possible to have traceroute host and ping host default to using the interface the cli was connected to?
We have the Management Interface of our PA 500 set to an internal address, like 192.168.129.11. We can connect to it from our mpls network using the IP assigned to that interface, example: 10.129.1.11, When we try a traceroute host or oping host the traffic uses the Management Interface gateway (192.168,129.1) instead of the gatesway of the mpls interface (10.129.1.1).
Is there a way to force those commands to use a different gateway/ethernet interface for egress?
TIA!
VV
... View more
03-17-2016
03:22 PM
We had a meeting with our MPLS provider yesterday and determined the same thing you posted about. They are willing to host startic routes but will not let us send updates to their routers.
I think we're to the point where we are going to rely on the netmask of the Local IP on the router to manage routing and not use OSPF at all.
Example:
Site 1
FW IP: 10.1.1.10/16
Router LAN IP 10.1.1.1/16
Subnets: 10.1.10.0/24, 10.1.80.0/24
MPLS Cloud
Site 2
FW IP: 10.2.1.10/16
Router LAN IP 10.2.1.1/16
Subnets: 10.2.10.0/24, 10.2.80.0/24
We would have to have the provider hard code routes for some legacy networks
on IP address groups 192.168.x.x and 172.16.x.x connect to the corporate firewall.
We will fail-over to an ipsec tunnel over the untrusted internet connection iof the mpls
network is down. We recongnize that this is a fail from a mesh to a hub and spoke.
Thanks for your response!
... View more
03-07-2016
11:34 AM
Thanks for the reply!
My testing shows that this approach works well. Now for the next hurdle... The consultant that ordered and configured the MPLS network put each node on a different network.
Example:
GW 10.2.1.1/16, Firewall 10.2.1.10
GW 10.3.1.1/16, Firewall 10.3.1.10
As a result the Firewalls do not locate any OSPF neighbors.
Is there a way to manually specify the OSPF neigbors since they are essentially on different networks?
I can have the MPLS network changed but that will break the current IPSec tunnels....
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-11-2019
01:42 PM
|
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks