This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About Warby
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About Warby
05-26-2020
88Posts
10Likes
8Solutions
May 26, 2020Last Visited
User
Activity
User
Profile
Latest posts by Warby
| Subject | Views | Posted |
|---|---|---|
| 4171 | 01-25-2018 04:17 PM | |
| 7487 | 01-23-2018 01:50 PM | |
| 2057 | 12-18-2017 01:18 PM | |
| 6300 | 12-10-2017 02:45 PM | |
| 4274 | 11-08-2017 10:39 AM | |
| 3094 | 09-25-2017 08:57 AM | |
| 3472 | 09-20-2017 07:01 PM | |
| 4054 | 09-18-2017 08:22 AM | |
| 4062 | 09-16-2017 03:08 PM | |
| 4221 | 08-26-2017 03:10 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 09-20-2017 07:01 PM | |
| 1 Like | 06-14-2017 01:40 PM | |
| 1 Like | 06-14-2017 07:58 AM | |
| 1 Like | 04-27-2017 10:12 AM | |
| 1 Like | 04-21-2017 11:27 AM |
My LIVEcommunity Articles Contributions
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like |
User Badges
Community Statistics
| Member Since | 12-01-2011 08:50 PM |
| Date Last Visited | 05-26-2020 01:17 PM |
| Posts | 88 |
| Total Likes Received | 5 |
01-25-2018
04:17 PM
The XFF to User-ID solution has been published on GitHub: https://github.com/PaloAltoNetworks/XFF-to-User-ID-mapping
... View more
01-23-2018
01:50 PM
Also, make sure the Juniper isn't configured for peer identification based on the IP address of the VM-Series because the VM-Series is configured with a private IP on the firewall but the packets arrive on the Juniper with a source IP of the IEP. When those don't match, peer identification fails. Instead, use something like FQDN or and email address as the peer identificaiton.
... View more
12-18-2017
01:18 PM
Hi Stacy, We didn't want to have an auto scaling solution that has an upper limit based on something that has nothing to do with when to scale (EIPs). We recommend using Panorama for management which negates the need for public IPs altogether. Warby
... View more
12-10-2017
02:45 PM
Hello, The easiest way to synchronize polices on multiple Palo Alto Networks firewalls is to use Panorama (our management station) to push policy. This works for all of our physical and virtual firewalls. Config elements can be shared or completely independant by device groups. Another option is to use a thrid party tool like Ansible to push configs to multiple firewalls. We have some sample Ansible plabooks available: https://live.paloaltonetworks.com/t5/Ansible/ct-p/Ansible The VM-Series firewalls can terminate IPsec tunnels very well. The decision to use the VM-Series versus the Azure VPN gateways should be based on the architecture, routing, performance, etc. HTH, Warby
... View more
11-08-2017
10:39 AM
Hi Greg, This should work and is supported. I've done this myself with no issues. Here are some things to try: double check your AWS security group for that ENI double check your subnet route if this ENI is on a different subnet then the management ENI, does that other subnet have an IGW route? SSH in and run the command: show counter global filter delta yes then launch your ping to the EIP and repeat the command above look for any drops as a last resort, override your default inter and intra security policy rules and turn on start/stop logging watch the traffic log HTH, Warby
... View more
09-25-2017
08:57 AM
Hello, Have a look at the cloud integration page: https://live.paloaltonetworks.com/t5/Public-Cloud-Integration/ct-p/Cloud_Templates There is an automation section with a link to some sample Ansible modules that may help you. If that isn't what you are looking for, please reply to this post with more details. Warby
... View more
09-20-2017
07:01 PM
1 Kudo
Hi Omar, This might be caused by a change in the bootstrap config files, change in S3 permissions, change in boostrap file locations, etc. If you can connect to the firewall management interface via HTTPs using the credentials in the boostrap file, then bootstrapping has succeeded. If you cannot, bootstrap may have failed for one of the reasons above. Sometimes the AWS console screenshot will shot bootstrapping success of failure. This might be difficult to troubleshoot here in this forum. As this solution is a TAC supported integration, I recommend you open a case to get troubleshooting asssitance. HTH, Warby
... View more
09-18-2017
08:22 AM
If you have both dataplance interfaces configured as the interface for the default route, you will get assymetric routing for one of the interfaces. Easiest solution is to remove the default route from one interface (say E1/2) and then setup a static route to use E1/2 for only the remote IPsec endpoint that should connect to that interface. Then you will need to setup static routes on the tunnel interfaces for the specific routes that should use each of the VPN tunnels. HTH, Warby
... View more
09-16-2017
03:08 PM
Hi Keith, How are you setting up the routing? If you have two data plane interfaces with public IPs, they cannot both ingest the default route or you will get odd behavior. You'll need to create a more specific static route on at least one of those interfaces for bringing up the tunnel. If you have both of the interfaces setup as DHCP, the default setting will be for them both to add the AWS gateway as the default route and you will get unpreditable results. Another test to try is to allow ping to/from both ends of both VPNs and make sure they are routing symmetrically. HTH, Warby
... View more
08-26-2017
03:10 PM
Hi KC Lee, One of our TMEs has a working prototype that uses Lambda to map IPs learned from XFF to a User-ID group that can then be blocked by policy. It isn't ready to be published as a template yet but if you'd like a preview, please reach out to your sales team to schedule a demo. HTH, Warby
... View more
08-26-2017
03:05 PM
Either Ansible (using our API) or Panorama can keep the configs in synch post deployment (while the firewall is running.)
... View more
08-10-2017
04:34 PM
There are several options for high availability in Azure. Check out our cloud integration page and expand the Azure section for some examples: https://live.paloaltonetworks.com/t5/Public-Cloud-Integration/ct-p/Cloud_Templates Firewall configurations can by synchronized accross multiple firewalls using: our Azure bootstrapping feature with a common config XML Panorama Ansible Our API We don't maintain session state in the public cloud as most cloud applications are designed to handle state and the infrastructure is stateless. This is true of other services as well like load balancers in Azure. If you want to have redundant firewalls for security between subnets, you will need to either: point a UDR at a primary interface and use an Azure function to move the UDR in the case of a failure front the redundant firewalls with an Azure LB and point a UDR to the LB Follow the link above for examples.
... View more
08-05-2017
03:00 PM
Your DNS idea should work. Another option is to create an address object that gets updated via our API when there is a change but I think the DNS option is cleaner. Or, better yet, can you change the EC2 instance to use an EIP? When the EC2 instances gets blown away the EIP gets disassociated but not released. Then you can re-associate the same EIP to the new EC2 instance. Then the firewall config won't need to change at all.
... View more
06-14-2017
01:40 PM
1 Kudo
It's a basic routing problem. Each subnet (even a /32) must be maped in the route table to/from a unique interface. The Azure load balancer always sources the probe from 168.63.129.16. If we have a default route for the external interface (say ethernet1/1), all responses to the healthcheck will go out ethernet1/1 even if the healthcheck came from the internal load balancer (on say ethernet1/2). This results in an asymmetric path and the health probe fails. If we then created a specific 168.63.129.16/32 route to use ethernet1/2, then the probes from the external load balancer would become assymetric and those healthchecks would fail. With multiple route tables, we could have one route table with a 168.63.129.16/32 static route that points to ethernet1/1 and another route table with a static entry for the same 168.63.129.16/32 for ethernet1/2. Make sense? Warby
... View more
06-14-2017
07:58 AM
1 Kudo
Hello, You have two choices here: One is to deploy another Azure load balancer just for outbound traffic and point your outbound UDR (default route) to the outbound load balancer. Azure allows such a configuration. The problem is, the healthcheck from the load balancer is always from the same IP address. So if you have one load balancer for inbound traffic and one load balancer for outbound traffic pointing to the same set of VM-Series firewalls, the firewalls will receive healthchecks from two different load balancers on two different interfaces but coming from the same IP address. This can be solved using two virtual routers on the firewall - one for each interface. The other option is to split inbound and outbound traffic to two different set of firewalls. Then each set of firewalls will only receive healthchecks from one load balancer. This adds VM-Series cost to the solution but it simplifies the routing and also has the advantage of having policy separation (inbound versus outbound). Also, the outbound firewalls can be used for multiple applications/resource groups in a hub and spoke model HTH, Warby
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-26-2020
01:17 PM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks