This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About jschoenB
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About jschoenB
10-24-2022
3Posts
0Likes
0Solutions
Oct 24, 2022Last Visited
User
Activity
User
Profile
Latest posts by jschoenB
| Subject | Views | Posted |
|---|---|---|
| 392 | 09-08-2022 01:51 AM | |
| 801 | 07-18-2022 05:50 AM | |
| 1012 | 07-18-2022 04:14 AM |
User Badges
Community Statistics
| Member Since | 06-23-2022 07:03 AM |
| Date Last Visited | 10-24-2022 01:34 PM |
| Posts | 3 |
09-08-2022
01:51 AM
Hi,
we are currently setting up a clean pipe for Cisco ACI setup, so the intra-ACI traffic will pass the vwire, to have basic IPS inspection done.
Our setup is an A/P HA with a vwire.
Cisco is using Layer-2 ping with ethercode 0x721 to check, if the path is free or blocked.
We have some issues with failovering and we doubted, that the L2-Pings are even sent out, because with packet-capture we cannot see anything. Also there was the case, that ACI saw both peers as up, but the passive firewall shouldn't pass any traffic on the vwire.
Does anyone of you got ideas regarding that? Maybe special config is necessary, to have this packets pass? I'm only aware of zone-protection settings, where we can exlude inspection for certain ethercodes, but ZP is not active on the vwire zones - also no counters are seen there.
Looking forward to any input
Best Regards
Johannes
... View more
07-18-2022
05:50 AM
For my understanding: The SDWAN Policy needs to be created with the SDWAN zones, so zone-internal, zone-internet, zone-to-branch and in the security policies I can use the mapped zones like trust, untrust and sdwan?
What zones should I see in the traffic logs?
... View more
07-18-2022
04:14 AM
I'm currently also doing the first steps with SDWAN.
We need to recycle the prexisting zones, so the preexisting SDWAN zone and Trust zone should be mapped to zone-to-branch and zone-internal, but that doesn't work.
Only the Untrust <> Zone-Internet mapping worked.
Also - how should the policy in Panorama and locally on the Firewall look like? Which logs should I expect to see on the firewall and in Panorama?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
10-24-2022
01:34 PM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks