About ClintL

Good morning everyone,   I have a weird issue that I think is related to how PBR or NAT works and/or something we need to program differently on our Palo Alto. I’ll try to explain our setup and the issue that occurred.   We have our main circuit that is utilized for VPN tunnels, NAT forwarding rules to our servers and pretty much anything that is not standard Internet traffic. We’ll call that Circuit A.   We have another circuit used for mostly standard outbound Internet traffic for certain VLANs. This is also the circuit that our DNS servers use for requests. It is high bandwidth but it is not a business class circuit with SLAs so it is not used for critical applications. We’ll call that Circuit B.   Like it was stated above, all NAT forwarding rules use Circuit A with the exception of one server (let’s call it Server 1) where we have a NAT forwarding rule that uses Circuit B. Note that this server is in a VLAN that uses Circuit A for outbound traffic.  This server also has several internal IP addresses associated with it and they all use Circuit A for outbound.  The NAT forwarding rule only points to one of these internal IP addresses.   Last night the ISP did planned maintenance on Circuit A which took it completely down. When this happened the NAT forwarding rule to Server 1 (which again goes over Circuit B) stopped working. My current guess is that somehow even though the NAT forwarding uses Circuit B to Server 1 it somehow uses Circuit A for outbound on this rule maybe on one of its other assigned internal IP addresses. I didn’t think NAT would work like that but nothing else comes to mind as to why the NAT forwarding rule to Server 1 over Circuit B would stop working. Any thoughts? Hopefully my explanation on our setup wasn’t confusing but if clarification is needed please let me know.  Thanks! ... View more

Hello all, I've had Agentless UserID working fine for over a year now.  Last week our PA-3020 running 6.0.3 stopped being able to identify users which it then started blocking all Internet browsing because it thought everyone was unauthenticated.  Nothing has changed on the firewall and to my knowledge nothing has changed on our AD servers.  The weird thing is I can still log into the firewall with my AD user account just fine.  I opened a ticket with Palo Alto and the tech confirmed that all my settings are correct.  The service account we use to access WMI is not locked out and I even reset the password just to be safe.  The AD servers (2008) show connected but when you run a "show user ip-user-mapping all" it returns no results.  I see no errors on the Palo and the Event Logs on the servers don't show anything that stands out.  Has anyone run into this before?  Palo tech support is basically stumped as am I.  The only thing I haven't done is reboot the Palo but I that is something I have to schedule downtime for. ... View more

Hello all, I am testing out SSL decryption on a few categories.  For now I am using a system generated certificate and it works in decrypting the categories I have selected.  The problem is that once it is decrypted, it doesn't use the proper security policy.  We have AD integration and URL filtering set up between certain groups.  My user ID has elevated browsing privileges but after the session is decrypted it uses the policy I have set up when the firewall doesn't know who the user is so I am getting blocked.  Any idea why it wouldn't use the correct security policy when the log view and blocked page are showing my user ID? ... View more

Hello all, I had a question regarding PBF and how the failover works. I have Internet circuit A and Internet circuit B, each through a different ISP.  All traffic and VPN tunnels go through circuit A.  I create a PBF rule to route web-browsing and ssl traffic only (using application-default) through circuit B.  It is my understanding that failover occurs when it cannot ping the gateway or whatever IP address you specify.  My question is, with my current scenario, which circuit is it using to initiate the ping?  Say it uses circuit A to initiate the ping and that circuit fails.  Wouldn't it try and failover the circuit even though circuit B is still up?  Keep in mind that you cannot create a PBF rule for the ping application as far as I know. ... View more

Hello all, I was wondering if a certain scenario is possible through a Palo Alto PA-3020.  Say we have a single ISP with an internal NAT rule pointing to internal server A that is accessible by anyone in the outside world.  If server A ever goes down (or we take it offline), the internal NAT rule will failover to another internal NAT rule pointing to server B.  These two servers are not load balanced nor are they accessed at the same time by the outside world.  The same external IP address will be used to access whichever server is online but again never both at the same time and of course both servers have different internal IP addresses in the same subnet. I'm thinking this would be accomplished with two NAT rules and one or two PBF rules.  What I am trying to figure out is how the Palo would know to use the other internal NAT rule if server A goes down.  Is something like this possible? ... View more