About BBHLTD

BBHLTD · ‎10-22-2012

We are planning to set up HA in Active Active mode. The boxes sit in separate locations with Layer 2 network between them. Currently our guest Network site on our second PA-2020 with our LAN on the first. Wer had to put the guest Network on second box as we had an issue where we was filling the arp table. When you run Active Active how does arp load sharing work? Do you get twice the size arp table? If one firewall went down do and all traffic is hitting one firewall do you still get twice the arp table? Hope this makes sense.

BBHLTD · ‎10-08-2012

We are preparing to configure High Availability in Active Active mode on our PA-2020 firewalls in London. Our first firewall sits in our main site in central London with our DR site sitting outside central London connected together via a 1Gbp Fibre. Both sites have a 200Mpb Internet connection so it would be good to make use of both. What options have we got for making best use of the pipes? What would the best way to configure H.A be? We are unable to directly attach the two Firewalls together so would creating a VLAN for HA work? I have attached a Diagram of our Network that may halp answer any questions, i'll probably have some more wuestions to ask so will put them on here when I can Cheers Joe

BBHLTD · ‎07-26-2012

I hope you may be able to answer a couple of quick questions for me as i am planning on switching Threat Protection on in the next few weeks. 1. When we turn on Threat Protection i remember you saying that the throughput for the dataplane is cut in half, Is there any way of monitoring the throughput of the dataplane? 2. When Threat protection is enabled will it limit the throughput for every Network/Port on the Firewall. From what I have read you have to configure Threat Protection on every policy, does that mean only limits the throughput on the zones. If you could help me with this it would be great. Cheers

BBHLTD · ‎05-08-2012

Hi all is there a way to monitor the throughput of the dataplane? I would like to turn on threat protection on my Palo's but I need to be able to log the throughput so I can see the effect it has. I am monitoring the Dataplane CPU but would like to also monitor the traffic. Any help possible would be grand. Thanks Joe Thurwood

BBHLTD · ‎04-23-2012

hi I had a working VPN tunnel and t was working for more than 100days then all of a sudden it stopped working and the rrrors i am getting is IKE phase-1 SA is deleted SA: MY-IP ADDRESS [500]- REMOTEIP_ADDRESS [500] cookie:ea25f2fa99b81f69:0000000000000000. 04/23 03:55:52 IKE phase-1 negotiation is failed as initiator, main mode. Failed SA: MY-IP ADDRESS8 [500]-8 REMOTEIP_ADDRESS [500] cookie:ea25f2fa99b81f69:0000000000000000. Due to timeout. even deleted the entry and reinput the key etc to no avail. Both the firewalls are Paloalto My side is PA-500 software version 4.1.1 Remote side PA2020 software version 4.1.1 Please help. Thanks,

Member Since	‎12-13-2011 07:16 PM
Date Last Visited	‎08-18-2015 09:07 AM
Posts	5
Total Likes Received	1

Online Status	Offline
Date Last Visited	‎08-18-2015 09:07 AM

About BBHLTD

ARP load sharing

High Availability across a Fibre connection

Threat Protection

Monitor throughput of dataplane using snmp

VPN tunnel Site to site failing

ARP load sharing

ARP load sharing

High Availability across a Fibre connection

Threat Protection

Monitor throughput of dataplane using snmp

VPN tunnel Site to site failing