LIVEcommunity - About howardtopher

howardtopher · ‎06-21-2019

Crap. I wish I had seen this or any notice anywhere before about 2 hours ago. I would have gone to 8.1.7. I only get one maintenace night a year to do these upgrades and now I'm probably stuck with this mess till next June. I've already dealt with globalprotect tunnel warnings that IPv6 is ignored (this here), and now this. My warning list is massive. I guess I could try and sneak in a 3am upgrade on a holiday when we're closed. Perhaps July 4th.

howardtopher · ‎11-07-2018

Our PAN-OS is 8.0.10. Maintenance night is next Friday, we'll jump to 8.0.13 at that point unless 8.0.14 gets released before then. Globalprotect is 4.1.5. I tried setting the timeout to 1 second and retries to 1 in the server profile, but that didn't make a difference. The globalprotect client says "connecting..." for a good 30 seconds before giving up (I haven't timed it, but it's feels long). The CLI fails over to the second server in the 1 second timeout that's configured.

howardtopher · ‎11-07-2018

For globalprotect I have a radius server profile with two servers in it. I have noticed that all authentication goes to the first server in the list all the time. And that works. However, in testing, I have shut off the first server and the firewall never tries to send authentcation to the second server. If I use the "test authentication" command on the firewall CLI, it does fail over to the second server and authentication succeeds. If I go back to the globalprotect client and try again, the firewall only tries the first server and authentication fails. I have verified this with packet captures on the actual radius servers. This seems to be incorrect behavior. Is it possible that there is a known bug about this? I'm using the same authentication profile in the globalprotect portal configuration as I am on the test CLI command.

howardtopher · ‎09-11-2018

So here's what I ended up doing. One portal. It's on a floating IP that floats from firewall to firewall as needed. Two gateways, one for each firewall. IP is on the interface itself, not floating. Each gateway has its own block of IPs for VPN terminations. Portal is configured to have both gateways with equal priority (let the client decide where to connect). So far this is the cleanest and removes the routing problem. The only issue is that failover is not clean for users that are currently connected as the client has to terminate one tunnel and reconnect to the other gateway, but it does work.

howardtopher · ‎09-07-2018

Yes, the DNS will round robin, but the expectation is that if a gateway/portal had gone offline users would still be able to get to the remaining one. There might be a delay as the connection times out and DNS gets hit again, Just a thought, but configuring a double of everything is a big pain.

howardtopher · ‎09-06-2018

I'm having a hard time finding much, if any, documentation on this scenario. I've tried a couple ways of doing it and they work, but I'm trying to figure out what the best way to do it while being as redundant as possible. What I like the best so far is to have the portal and a gateway up on a floating IP so it can bounce from one firewall to the other as needed. However, doing that adds a route to the virtual router on both firewalls for the tunnel (client) addresses. If a client connects and gets terminated to the tunnel interface on firewall 1, accesses a service, and then return traffic comes back into firewall 2, it dies because it thinks the client is on that tunnel interface, when it isn't. Does that make sense? If there was a way to have the tunnel interface also follow the floating IP that would be great. This would only install the route on the firewall that needs it. Another way I thought of doing it is a portal and gateway on firewall 1, and a portal and a gateway on firewall 2. Then in my DNS, the portal DNS record (vpn.domain.com) answers with both portals and the gateway DNS record (gw.domain.com) answers with both gateways. That doubles the configuration that has to be made, but solves the route being installed on both firewalls when clients are only connected to one firewall. Is there a proper way to do this?

howardtopher · ‎07-27-2018

New to SSL Inbound Inspection here. Running 8.0.10 at the moment. Have a pair of 5050s running in active/active HA. I think I have everything configured properly as it appears to be working, mostly. When I initiate a connection from client to server and then look at traffic logs, one firewall decrypts traffic fine, the other one has a bunch of "decrypt-error" messages. If I initate a new connection, the firewall that had the errors now decrypts fine and the one that was working has the decrypt-error messages. It almost appears like which ever firewall "owns" the session decrypts ok and the other "peer" gets all the decrypt-error logs. Is this normal or have I done something incorrectly?

howardtopher · ‎08-16-2017

Ahh, thank you so much. You're a life saver!

howardtopher · ‎08-16-2017

When making changes to firewalls through panorama, there is a history of those changes made. When you go to the dashboard there is a widget that shows the last handful of config changes, so I know they are there. Where in panorama can I go to view the history of that log? There is no "configuration" section under the monitor tab like there is for a normal firewall.

howardtopher · ‎07-31-2017

That's unfortunate. I was hoping to add that interface to my "outside world connectivity" dashboard, but I guess that won't be happening.

howardtopher · ‎07-18-2017

Using physical PA boxes, this works fine. However, with the VM version (at least in Azure) it does not. Only the mgmt interface shows any traffic when reading interface statistics through SNMP. Is this a known issue? ethernet1/1 is the untrusted interface and I'd like to chart utilization of it, but it just stays 0. IF-MIB::ifInOctets.1 = Counter32: 271149367 IF-MIB::ifInOctets.2 = Counter32: 0 IF-MIB::ifInOctets.3 = Counter32: 0 IF-MIB::ifInOctets.4 = Counter32: 0 IF-MIB::ifInOctets.5 = Counter32: 0 IF-MIB::ifInOctets.6 = Counter32: 0 IF-MIB::ifInOctets.7 = Counter32: 0 IF-MIB::ifInOctets.8 = Counter32: 0 IF-MIB::ifDescr.1 = STRING: mgmt IF-MIB::ifDescr.2 = STRING: ethernet1/1 IF-MIB::ifDescr.3 = STRING: ethernet1/2 IF-MIB::ifDescr.4 = STRING: ethernet1/3 IF-MIB::ifDescr.5 = STRING: ethernet1/4 IF-MIB::ifDescr.6 = STRING: ethernet1/5 IF-MIB::ifDescr.7 = STRING: ethernet1/6 IF-MIB::ifDescr.8 = STRING: ethernet1/7

howardtopher · ‎05-02-2017

I just upgraded our panorama to 8.0.2. We don't have any external log collectors and only store logs locally on panorama. I'm don't seem to be able to start the log migration process. The error it gives is the serial numer is invalid. I'm using the panorama serial number in the command. Am I doing something wrong? Do I have to convert to "panorama mode" first? > request logdb migrate lc serial-number xxxxxxxxxxx start Server error : xxxxxxxxxxx is invalid serial-number.Current target-vsys is none request -> logdb -> migrate -> lc -> serial-number is invalid

howardtopher · ‎02-16-2017

I opened a case with support to ask them. I ended up having to use custom templates to deploy 7.1 in Azure. Honestly, it was a real pain and I'm not sure why Microsoft can't give us a choice of what version to install from the marketplace. Anyway, it worked and I now have a 7.1 VM in Azure.

howardtopher · ‎02-15-2017

Now that 8.0 is out, is it not possible to deploy a 7.1 VM in Azure? I see no options to choose and it deploys a 8.0 VM when you do it. I tried downgrading to 7.1 and get "New format of serial assigned for VM. This VM cannot be downgraded." So it appears I'm forced to deploy 8.0? I don't know about you guys, but I hate going to a new major revision without at least a couple maintenace releases out. Also, this is going to go in our Panorama, and I certainly don't want to upgrade our Panorama to 8.0 yet. Am I stuck with 8.0?

howardtopher · ‎09-01-2016

Thanks. That's how it's working, I just wanted to make sure there wasn't a way around it before I got too far down that road. I changed the setting in Panorama to keep it from syncing unused object to the firewall so at least the firewalls will have only used objects on them. I'll just have to be careful on naming conventions in Panorama to keep from duplicating anything.

Member Since	‎05-18-2015 07:06 PM
Date Last Visited	‎08-03-2020 10:34 AM
Posts	26
Total Likes Received	6

Online Status	Offline
Date Last Visited	‎08-03-2020 10:34 AM

Re: Application Dependency Warnings even when allowing required apps

Re: GlobalProtect portal user authentication failed

GlobalProtect portal user authentication failed

Re: GlobalProtect with Active/Active HA

Re: GlobalProtect with Active/Active HA

Re: GlobalProtect with Active/Active HA

GlobalProtect with Active/Active HA

Re: v7.1 in Azure

Re: Active/Active L3 problem with asymmetric routing and NAT

Re: OSPF between virtual routers

Re: Application Dependency Warnings even when allowing required apps

Re: GlobalProtect portal user authentication failed

GlobalProtect portal user authentication failed

Re: GlobalProtect with Active/Active HA

Re: GlobalProtect with Active/Active HA

GlobalProtect with Active/Active HA

SSL Inbound Inspection with Active/Active HA

Re: Panorama configuration logs

Panorama configuration logs

Re: Monitoring interface traffic with SNMP

Monitoring interface traffic with SNMP

Re: Upgrading 7.1 to 8.0: New Log Storage

Re: v7.1 in Azure

v7.1 in Azure

Re: Panorama - address object use in templates

Network Security

Cloud Security

Security Operations