Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About howardtopher
About howardtopher
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
08-03-2020
26Posts
5Likes
2Solutions
Aug 03, 2020Last Visited
User
Activity
User
Profile
Latest posts by howardtopher
| Subject | Views | Posted |
|---|---|---|
| 7696 | 06-21-2019 06:36 PM | |
| 3066 | 11-07-2018 12:43 PM | |
| 3072 | 11-07-2018 10:15 AM | |
| 4063 | 09-11-2018 11:24 AM | |
| 4072 | 09-07-2018 10:17 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 | 09-11-2018 11:24 AM | |
| 1 | 09-06-2018 06:45 PM | |
| 1 | 02-16-2017 09:25 AM | |
| 1 | 08-26-2015 10:51 AM | |
| 1 | 08-21-2015 01:31 PM |
User Badges
Public Statistics
| Date Registered | 05-18-2015 07:06 PM |
| Date Last Visited | 08-03-2020 10:34 AM |
| Total Messages Posted | 26 |
| Total Likes Received | 5 |
06-21-2019
06:36 PM
Crap. I wish I had seen this or any notice anywhere before about 2 hours ago. I would have gone to 8.1.7. I only get one maintenace night a year to do these upgrades and now I'm probably stuck with this mess till next June. I've already dealt with globalprotect tunnel warnings that IPv6 is ignored (this here), and now this. My warning list is massive. I guess I could try and sneak in a 3am upgrade on a holiday when we're closed. Perhaps July 4th.
... View more
11-07-2018
12:43 PM
Our PAN-OS is 8.0.10. Maintenance night is next Friday, we'll jump to 8.0.13 at that point unless 8.0.14 gets released before then. Globalprotect is 4.1.5. I tried setting the timeout to 1 second and retries to 1 in the server profile, but that didn't make a difference. The globalprotect client says "connecting..." for a good 30 seconds before giving up (I haven't timed it, but it's feels long). The CLI fails over to the second server in the 1 second timeout that's configured.
... View more
11-07-2018
10:15 AM
For globalprotect I have a radius server profile with two servers in it. I have noticed that all authentication goes to the first server in the list all the time. And that works. However, in testing, I have shut off the first server and the firewall never tries to send authentcation to the second server. If I use the "test authentication" command on the firewall CLI, it does fail over to the second server and authentication succeeds. If I go back to the globalprotect client and try again, the firewall only tries the first server and authentication fails. I have verified this with packet captures on the actual radius servers. This seems to be incorrect behavior. Is it possible that there is a known bug about this? I'm using the same authentication profile in the globalprotect portal configuration as I am on the test CLI command.
... View more
09-11-2018
11:24 AM
1 Kudo
So here's what I ended up doing. One portal. It's on a floating IP that floats from firewall to firewall as needed. Two gateways, one for each firewall. IP is on the interface itself, not floating. Each gateway has its own block of IPs for VPN terminations. Portal is configured to have both gateways with equal priority (let the client decide where to connect). So far this is the cleanest and removes the routing problem. The only issue is that failover is not clean for users that are currently connected as the client has to terminate one tunnel and reconnect to the other gateway, but it does work.
... View more
09-07-2018
10:17 AM
Yes, the DNS will round robin, but the expectation is that if a gateway/portal had gone offline users would still be able to get to the remaining one. There might be a delay as the connection times out and DNS gets hit again, Just a thought, but configuring a double of everything is a big pain.
... View more
09-06-2018
06:45 PM
1 Kudo
I'm having a hard time finding much, if any, documentation on this scenario. I've tried a couple ways of doing it and they work, but I'm trying to figure out what the best way to do it while being as redundant as possible. What I like the best so far is to have the portal and a gateway up on a floating IP so it can bounce from one firewall to the other as needed. However, doing that adds a route to the virtual router on both firewalls for the tunnel (client) addresses. If a client connects and gets terminated to the tunnel interface on firewall 1, accesses a service, and then return traffic comes back into firewall 2, it dies because it thinks the client is on that tunnel interface, when it isn't. Does that make sense? If there was a way to have the tunnel interface also follow the floating IP that would be great. This would only install the route on the firewall that needs it. Another way I thought of doing it is a portal and gateway on firewall 1, and a portal and a gateway on firewall 2. Then in my DNS, the portal DNS record (vpn.domain.com) answers with both portals and the gateway DNS record (gw.domain.com) answers with both gateways. That doubles the configuration that has to be made, but solves the route being installed on both firewalls when clients are only connected to one firewall. Is there a proper way to do this?
... View more
- Tags:
- globalprotect
- ha
07-27-2018
02:14 PM
New to SSL Inbound Inspection here. Running 8.0.10 at the moment. Have a pair of 5050s running in active/active HA. I think I have everything configured properly as it appears to be working, mostly. When I initiate a connection from client to server and then look at traffic logs, one firewall decrypts traffic fine, the other one has a bunch of "decrypt-error" messages. If I initate a new connection, the firewall that had the errors now decrypts fine and the one that was working has the decrypt-error messages. It almost appears like which ever firewall "owns" the session decrypts ok and the other "peer" gets all the decrypt-error logs. Is this normal or have I done something incorrectly?
... View more
08-16-2017
11:56 AM
When making changes to firewalls through panorama, there is a history of those changes made. When you go to the dashboard there is a widget that shows the last handful of config changes, so I know they are there. Where in panorama can I go to view the history of that log? There is no "configuration" section under the monitor tab like there is for a normal firewall.
... View more
07-31-2017
01:13 PM
That's unfortunate. I was hoping to add that interface to my "outside world connectivity" dashboard, but I guess that won't be happening.
... View more
07-18-2017
10:46 AM
Using physical PA boxes, this works fine. However, with the VM version (at least in Azure) it does not. Only the mgmt interface shows any traffic when reading interface statistics through SNMP. Is this a known issue? ethernet1/1 is the untrusted interface and I'd like to chart utilization of it, but it just stays 0. IF-MIB::ifInOctets.1 = Counter32: 271149367 IF-MIB::ifInOctets.2 = Counter32: 0 IF-MIB::ifInOctets.3 = Counter32: 0 IF-MIB::ifInOctets.4 = Counter32: 0 IF-MIB::ifInOctets.5 = Counter32: 0 IF-MIB::ifInOctets.6 = Counter32: 0 IF-MIB::ifInOctets.7 = Counter32: 0 IF-MIB::ifInOctets.8 = Counter32: 0 IF-MIB::ifDescr.1 = STRING: mgmt IF-MIB::ifDescr.2 = STRING: ethernet1/1 IF-MIB::ifDescr.3 = STRING: ethernet1/2 IF-MIB::ifDescr.4 = STRING: ethernet1/3 IF-MIB::ifDescr.5 = STRING: ethernet1/4 IF-MIB::ifDescr.6 = STRING: ethernet1/5 IF-MIB::ifDescr.7 = STRING: ethernet1/6 IF-MIB::ifDescr.8 = STRING: ethernet1/7
... View more
05-02-2017
02:16 PM
I just upgraded our panorama to 8.0.2. We don't have any external log collectors and only store logs locally on panorama. I'm don't seem to be able to start the log migration process. The error it gives is the serial numer is invalid. I'm using the panorama serial number in the command. Am I doing something wrong? Do I have to convert to "panorama mode" first? > request logdb migrate lc serial-number xxxxxxxxxxx start Server error : xxxxxxxxxxx is invalid serial-number.Current target-vsys is none request -> logdb -> migrate -> lc -> serial-number is invalid
... View more
02-16-2017
09:25 AM
1 Kudo
I opened a case with support to ask them. I ended up having to use custom templates to deploy 7.1 in Azure. Honestly, it was a real pain and I'm not sure why Microsoft can't give us a choice of what version to install from the marketplace. Anyway, it worked and I now have a 7.1 VM in Azure.
... View more
02-15-2017
08:27 AM
Now that 8.0 is out, is it not possible to deploy a 7.1 VM in Azure? I see no options to choose and it deploys a 8.0 VM when you do it. I tried downgrading to 7.1 and get "New format of serial assigned for VM. This VM cannot be downgraded." So it appears I'm forced to deploy 8.0? I don't know about you guys, but I hate going to a new major revision without at least a couple maintenace releases out. Also, this is going to go in our Panorama, and I certainly don't want to upgrade our Panorama to 8.0 yet. Am I stuck with 8.0?
... View more
09-01-2016
11:50 AM
Thanks. That's how it's working, I just wanted to make sure there wasn't a way around it before I got too far down that road. I changed the setting in Panorama to keep it from syncing unused object to the firewall so at least the firewalls will have only used objects on them. I'll just have to be careful on naming conventions in Panorama to keep from duplicating anything.
... View more
09-01-2016
08:01 AM
In panorama I'm having to mark address objects as "shared" in order to access them in a template. I'm curious if this is by design or if I've done something wrong. This panorama install is brand new so I'm still learning and the firewalls I'm setting up are not live yet. After I get this going I have other firewalls to import. I have one device group with two firewalls in it. The firewalls are active/active. I have two template stacks, one for each firewall. Each stack contains a "common" template with settings that are the same between both firewalls and a "specific" template for the settings are are specific to each firewall. (The common one contains things like syslog server definitions, user-id, etc. The specific ones contain interface definitions, etc) Currently if I try to set an address object on an interface (in the specific template) I cannot select it from the drop down unless the address object is marked as shared. I was hoping to keep the address objects for the interfaces only in the device group. These templates are only for the firewalls in that device group.
... View more
08-23-2016
07:45 AM
In the Active/Active HA setup, there is an option to "Enable Config Sync". In the past I have used this because I didn't have Panorama. Now I have a new set of PA5050s that are running in Active/Active mode and we purchased Panorama to go with it. My question is should I enable the config sync? Or should I disable it since Panorama pushes to each device individually? I'm not able to find any documentation recommending one way or the other.
... View more
08-26-2015
10:51 AM
1 Kudo
It took a while, but support eventually agreed there was a problem. While they take a look at all the files and packet captures they took, I tried a downgrade to 6.1.6. My configuration works perfectly there. So this issue is definitely v7 related.
... View more
08-21-2015
01:31 PM
1 Kudo
I've done it with BGP. I use a physical interface IP (or subinterface IP) on each virtual router and peer between the two. This way the traffic does not leave the firewall. For example: interface e 1/1 has IP 10.10.10.1/30 in VR1 interface e 1/2 has IP 10.10.11.1/30 in VR2 In VR1, set a static route pointing 10.10.11.1/30 to "next vr" VR2. In VR2 do the same with a static route pointing 10.10.10.1/30 to "next vr" VR1. After that you can configure the BGP peering. Make sure to use iBGP and the "export next hop" as "use self". You'll have to set import and export rules up. Export rules in VR1 to set what gets advertised to VR2, and then a matching import rule in VR2 to accept only those exports from VR1. And the other way around to get a two-way route exchange. Going from zone to zone you're going to need a gateway protocol. I don't think OSPF will work like this.
... View more
08-20-2015
08:18 AM
These are a new install so I started out with PAN-OS 7.0.1. At this point I'm almost curious if I need to go back to PAN-OS 6 and try the same config and see if the problem persists there. I've opened a ticket with support so maybe they can figure out what's going on.
... View more
08-20-2015
06:51 AM
I tried duplicating pools for each firewall and I'm still having the same results. If a SYN leaves one firewall and the SYNACK comes back into the other firewall the SYNACK never makes it back to the originating host. However, if the SYNACK comes back to the same firewall the SYN left from it's all good.
... View more
08-19-2015
06:42 PM
From what I've seen in trying things and read so far is if you are using pools then you have to split the pool and give half to each node. I've done that and that seems to work great so far. The only caveat to that is that you have to make sure you route the correct half to the correct node. Basically, if I have a /24 pool, I split that into two /25s and give the lower half to node 0 and the upper half to node 1. And then on my external routers make sure that the lower /25 is routed to only node 0 and not node 1 and visa versa. If I could put the whole pool on each node so that traffic can come back in asymmetrically that would be great, but I haven't been able to get that to work. However, I can live with that split. The problem I'm having is for addresses outside of the pool that get used in a 1-1 type fashion. Internal host x always has address y on the outside and I can allow external hosts access to services hosted on that internal host. The asymmetrical traffic seems to be broken somewhere. I've dug through logs and have not seen anything show up. I have the nat rule binding set to both.
... View more
08-19-2015
12:16 PM
The server has an internal IP (ie 10.11.12.13) and on the external side of the firewall it has a publicly routable IP (ie 100.101.102.103). I have set up a source NAT, set it to bi-directional, and have the binding set to both. I also tried removing the bi-directional part and setting up my own destination NAT rule for it with binding set to both and it still didn't work. I'm making the assumption that bi-directional just means it automatically creates the destination NAT rule for you.
... View more
08-19-2015
08:31 AM
I'm stumped. I've looked through as many pieces of documentation and discussions as I can find and I think I have everything set up correctly, but it's only half working. What I have is two PA-5050s in Active/Active. I have two routers on the outside, each has a L3 connection to both firewalls. I have two routers on the inside, each has a L3 connection to both firewalls. On the inside both firewalls are using OSPF to both routers and have full route tables containing all internal routes. On the outside right now I have static routes set up, to point NAT addresses back at the firewalls. I have all of my static NAT address ranges pointed to both firewalls on both outside routers using ECMP. I have the dynamic NAT ranges pointed to just the firewall that owns them. Internal to each firewall I have BGP running between the outside zone and the inside zone for route sharing. Looking at routing tables in both outside routers, both inside routers, and both PA firewalls, everything is 100% complete. I don't think this is the problem. For dynamic source NAT, I split my pools in half and gave half to each firewall. Any internal hosts that receive a dynamic NAT when accessing the internet works 100% fine. The problem comes when I want to have a static NAT for a public server behind the firewall. Right now I have 2 servers for testing. One of them works fine, the other does not. I've used wireshark on the outside routers and for the working server I see traffic leave and re-enter the same firewall. For the one that does not work, I see the traffic leave one firewall and enter through the other. I see the SYN packet leave one firewall destined for the internet, the return SYN-ACK gets sent to the other firewall and it dies there. The internal server never sees it. I've checked session tables on both firewalls and both contain the session information, although one says "active" and the other says "init". Route tables look good. I thought that with active/active returning traffic could enter the other firewall and since it knows about the session it would go ahead and just route it, or even send it over the HA3 link to the session owner, but best I can tell neither of those is happening. Does anyone have any idea where I've gone wrong? Am I misunderstanding something somewhere? Does any of this make sense? 😉
... View more
05-21-2015
03:30 PM
I figured BGP would be the way to go, but I was unsure of exactly how to pull it off. It took me a couple days to get around to it, but I just finished trying it out and it works perfectly. Thanks so much for pointing me in the right direction.
... View more
05-18-2015
08:05 PM
I have a firewall running in layer-3 mode. I've got multiple separate virtual routers on the inside, there is no overlapping address space in any of these. I need all of these to share one outside internet connection. I'd like to do it without static routes (other than the main default to the outside). Right now I have the outside virtual router separate from the inside ones. In the inside virtual routers, I am advertising a default route in OSPF with a next hop pointing to the outside virtual router. My problem is coming back in from the outside. Traffic comes into the outside virtual router, but it doesn't know where to go. I can static 10/8, 172.16/12, and 192.168/16 back into one of the inside virtual routers, but not all at the same time. I could go through and manually list each individual route as statics back to the proper inside virtual router, but I really don't want to have to keep up with that. One idea I've come up with is to run BGP between each inside virtual router and the outside virtual router and redistribute OSPF into BGP so it knows what routes are in each virtual router. But not redistribute BGP back into OSPF. I don't want to bridge the inside virtual routers, I want users to go outside and back in to get from one to the other. Is this a good way to do it? Is there another, or better way to accomplish this?
... View more
Labels:
- Labels:
-
Configuration
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-03-2020
10:34 AM
|
Latest Blogs
Latest Posts
Copyright 2007 - 2020 - Palo Alto Networks
