About LouisScaringella

I'm sorry to complain, but there are a number of issues i've found with this software. I've allocated ample resources to the VM.    1. The UI is really laggy, unresponsive, and the filter window often doesn't rspond to being closed.  2. It is not auto processing CSV files and deleting them as it is configured. 3. The API generation creates invalid calls for address objects.  ... View more

I have a Tech Note for the YouTube for Schools and Google, Bing, and Yahoo SafeSearch. However, I cannot seem to find the VM for the proxy server that Palo Alto has created. Is there a link for this somewhere? ... View more

Hello, I have a VPN tunnel between a Palo Alto and a Juniper SSG. Even when there is no traffic from the end devices coming through, the VPN tunnel somehow stays up. I would expect the IKE and IPSEC SA's to time out and stay down until traffic is passed. However, the IPsec tunnel stays up. It seems that the Palo Alto is initiating the connection even though I know no traffic is coming through it for the VPN to become active. I see in the logs that the Palo is the initiator and it brings up the tunnel consistently after about an hour which is when the IPsec SA expires (lifetime is 1 hour). Any ideas why this happens? On other tunnels I have this does not happen the tunnel stays down when inactive. I have noticed that those other tunnels are terminating to Cisco ASAs and not a SSG as is the case with the one I was referring to above. I am really curious why this happens. I even disabled dead peer detection to test and it made no difference. I do not see a setting in the Palo that would enable/disable this. Thanks, -Louis ... View more

Hello, I had a quick question about destination NATing to an address not in the same subnet as an interface on the Palo Alto. For example, let's say I have a site-to-site VPN and I am using destination NAT on one side of the tunnel. When traffic comes from one side of the tunnel to the other, destination NAT is performed. One side uses 10.124.4.50/24 as its destination. The firewall on the other side then uses destination NAT to translate this traffic to 10.1.1.50/24. I have seen articles on the Palo website that say you must have a route for this NAT address or have an interface with an IP in that subnet assigned. I have done destination NAT a number of times to public address spaces to a subnet that did not physically belong to an interface on the Palo. For example, the public address of the Palo is 209.209.209.209 and I am destination NATing a server from 207.207.207.207 to 192.168.50.250. In these cases, I never created a route manually for the before-NAT address/subnet. Is this something that has changed with recent PAN-OS codes? I ask because I came across a situation similar to what I described above with a VPN tunnel. The other side of the tunnel needed a route for the subnet they were NATing to/from in order for the policy to work. I never had to do this in the cases I have seen, so I am curious why. Any ideas? ... View more

I understand that both firewalls should have the same feature licensing for proper failover, but has anyone implemented HA successfully using two different models? 5050 and 5020 for example? I know in the documentation it states both models must be the same. ... View more