About Sanjay_Ramaiah

Hi All, When it comes to Static NAT it will be one to one NAT in vendors like Checkpoint and Cisco ASA. I am bit confused with the NAT configuration in Palo Alto. Went through config guide and examples of NAT as well but still confused. We have a scenario as below. We have 3 zones - WAN, LAN and DMZ. Users want to reach DMZ interface from WAN and vice versa. IP: 10.10.10.10 shd be translated to 1.1.1.2 WAN Int: 1.1.1.1/29 So ACL is configured as below: WAN to DMZ Zones port 443 is allowed. Src Int: WAN Src: Any Dst Int: DMZ Dst: 1.1.1.2 Port: 443   Src Int: DMZ Src: 10.10.10.10 Dst Int: WAN Dst: Any Port: 443   NAT: Src Zone: DMZ Dst Zone: WAN Dst Int: WAN Src Add: 10.10.10.10 Dst Add:Any Src Trans: Static IP(1.1.1.2)Bi-directional Dst Trans:none   Src Zone:WAN Dst Zone: DMZ Dst Int:DMZ Src Add:Any Dst Add:1.1.1.2 Src Trans:none Dst Trans:dst-translation(10.10.10.10)   Is there anything wrong with this?   Though 1.1.1.2 is directly connected to WAN. Traffic from outside to 1.1.1.2 to is going to LAN interface instead of DMZ. I am concerned with my NAT understanding in Palo.   Any suggestions on this would really help.    Regards, Sanjay S     ... View more

Hi All, I have excluded few of the domains in Split Tunnel config. I am not able to verify if the split tunnel is working curretly. If we check the route print we are not seeing any difference in the route table. Is there any way i can test this or confirm the split tunnel is working? Also is it necessary to * before the domain? For example *protection.outlook.com or only protection.outlook.com works? Please suggest. ... View more

Hi Team, We have implemented SAML authentication for GP users. Since then the Source User logs are being seen as email IDs and not with the SAMACCOUNTNAME. So the rules implemented with the LDAP user groups are not working. Is there any way we can get this sorted? Regards, Sanjay S ... View more

Hi Team, We are facing issues with the M365 via prisma. If we bypass prisma it feels better to access. If it is via Prisma it is pretty slow. Any suggestions on how to troubleshoot this issue. Regards, Sanjay S ... View more

Hi All, We have configured different port for syslog in the PA-460 firewall.  Server Profile > Syslog > Name, Syslog server, Transport, Port(Here we used different port than default 514). But we can still see the syslog traffic is being generated with the default port 514 itself. Is there any additinal steps that i need to follow to get this setup working with the different port? Regards, Sanjay S ... View more

Hi All, I need some information on checking the logs. I see few things like END, DENY, SPYWARE, INFORMATION etc and in the action we see it as allowed. But the access will not be working. May i know what this Log Subtype means and what information will it give us in troubleshooting? When it says ALLOW as action then why in Subtype it is Deny. How to troubleshoot these issues? Regards, Sanjay S ... View more