About Matt_Harrell

Matt_Harrell · ‎12-06-2013

I'm trying to delete an SSL certificate from a Palo Alto cluster I'm setting up via Panorama. It tells me the cert cannot be deleted due to this reason: because of references from: template -> {firewall cluster name} -> config -> devices -> localhost.localdomain -> vsys -> vsys1 -> captive-portal -> server-certificate I remember messing around with Captive Portal and it did involve this certificate, but when I check the Captive Portal section of the configuration, either in Panorama, or in the primary/active firewall, there's nothing there at all. Any thoughts on where to find this?

Matt_Harrell · ‎10-07-2013

I'm trying to figure out the best settings for TCP (SYN) and UDP flood protection for our firewalls, but I'm struggling because I can't find the data I need. I found "New connection established rate" with the "show session info" command; however, I'm assuming this is for TCP and UDP combined. Since these are broken apart in flood protection, I need them separately in the data, as well. To properly protect against floods without overly limiting the number of new connections, I need a total in the Maximum setting for both TCP and UDP that does not go over the stated maximum of the firewall, but also accurately reflects the connections per second (cps) for each IP protocol (TCP and UDP). The only way I can think to get a reasonable estimate for each cps is to look at the number of active UDP and TCP sessions and make a ratio out of that, then set the Maximum value (and maybe Alert and Activate) based on that ratio. I'd rather find the actual cps for TCP and UDP separately. Thoughts?

Matt_Harrell · ‎04-12-2012

We are a new Palo Alto customer, and although so far I'm liking the PA-500 HA cluster I'm setting up a great deal (after two evaluations of Palo Altos in the last few years), the extremely long commit times are one of my biggest issues with these firewalls. They take so long that I have gotten in the habbit of working on something else during the commit. This may be acceptable for this cluster, which is only for our PC Internet access and VPN gateway, but this may be a sticking point for us in considering Palo Altos for the lease replacement of our HA firewall cluster that's protecting our online application (which will have a far more complicated configuration). I would like to think that this is a high priority for Palo Alto Networks to get resolved in future releases (we are on 4.1.4 right now, and these firewalls are not yet in production).

Matt_Harrell · ‎04-02-2012

I'm new to Palo Alto firewalls. I'm setting up a PA-500 active/passive HA cluster, replacing an HA cluster of Sidewinder v7 (McAfee Firewall Enterprise) firewalls. I know from many years of experience with that type of firewall and from talking to tech support that using network objects of the FQDN type (requiring DNS lookups) is a bad thing for firewall performance, and has even caused us major downtime in the past. Is using FQDN objects in Palo Alto (PanOS 4.1.4) a similarly bad thing? It must have to perform DNS lookups at some time, but this is also why they can be handy, so I don't have to try to keep IP addresses up-to-date in the firewall.

Date Registered	‎01-10-2012 12:42 PM
Date Last Visited	‎11-03-2020 09:19 AM
Total Messages Posted	7

Online Status	Offline
Date Last Visited	‎11-03-2020 09:19 AM

About Matt_Harrell

Can't find where an SSL cert is in use

Separate TCP and UDP cps stats?

Re: PA-2050 commit frustration

Potential firewall performance issues when using FQDNs?

Re: Can't find where an SSL cert is in use

Management CPU still an issue

Can't find where an SSL cert is in use

Separate TCP and UDP cps stats?

Re: PA-2050 commit frustration

Potential firewall performance issues when using FQDNs?

Strata

Prisma

Cortex

About Matt_Harrell