About ClintL

Good morning everyone,   I have a weird issue that I think is related to how PBR or NAT works and/or something we need to program differently on our Palo Alto. I’ll try to explain our setup and the issue that occurred.   We have our main circuit that is utilized for VPN tunnels, NAT forwarding rules to our servers and pretty much anything that is not standard Internet traffic. We’ll call that Circuit A.   We have another circuit used for mostly standard outbound Internet traffic for certain VLANs. This is also the circuit that our DNS servers use for requests. It is high bandwidth but it is not a business class circuit with SLAs so it is not used for critical applications. We’ll call that Circuit B.   Like it was stated above, all NAT forwarding rules use Circuit A with the exception of one server (let’s call it Server 1) where we have a NAT forwarding rule that uses Circuit B. Note that this server is in a VLAN that uses Circuit A for outbound traffic.  This server also has several internal IP addresses associated with it and they all use Circuit A for outbound.  The NAT forwarding rule only points to one of these internal IP addresses.   Last night the ISP did planned maintenance on Circuit A which took it completely down. When this happened the NAT forwarding rule to Server 1 (which again goes over Circuit B) stopped working. My current guess is that somehow even though the NAT forwarding uses Circuit B to Server 1 it somehow uses Circuit A for outbound on this rule maybe on one of its other assigned internal IP addresses. I didn’t think NAT would work like that but nothing else comes to mind as to why the NAT forwarding rule to Server 1 over Circuit B would stop working. Any thoughts? Hopefully my explanation on our setup wasn’t confusing but if clarification is needed please let me know.  Thanks! ... View more

Hello all, I've had Agentless UserID working fine for over a year now.  Last week our PA-3020 running 6.0.3 stopped being able to identify users which it then started blocking all Internet browsing because it thought everyone was unauthenticated.  Nothing has changed on the firewall and to my knowledge nothing has changed on our AD servers.  The weird thing is I can still log into the firewall with my AD user account just fine.  I opened a ticket with Palo Alto and the tech confirmed that all my settings are correct.  The service account we use to access WMI is not locked out and I even reset the password just to be safe.  The AD servers (2008) show connected but when you run a "show user ip-user-mapping all" it returns no results.  I see no errors on the Palo and the Event Logs on the servers don't show anything that stands out.  Has anyone run into this before?  Palo tech support is basically stumped as am I.  The only thing I haven't done is reboot the Palo but I that is something I have to schedule downtime for. ... View more

Hello all, I am testing out SSL decryption on a few categories.  For now I am using a system generated certificate and it works in decrypting the categories I have selected.  The problem is that once it is decrypted, it doesn't use the proper security policy.  We have AD integration and URL filtering set up between certain groups.  My user ID has elevated browsing privileges but after the session is decrypted it uses the policy I have set up when the firewall doesn't know who the user is so I am getting blocked.  Any idea why it wouldn't use the correct security policy when the log view and blocked page are showing my user ID? ... View more

Hello all, I had a question regarding PBF and how the failover works. I have Internet circuit A and Internet circuit B, each through a different ISP.  All traffic and VPN tunnels go through circuit A.  I create a PBF rule to route web-browsing and ssl traffic only (using application-default) through circuit B.  It is my understanding that failover occurs when it cannot ping the gateway or whatever IP address you specify.  My question is, with my current scenario, which circuit is it using to initiate the ping?  Say it uses circuit A to initiate the ping and that circuit fails.  Wouldn't it try and failover the circuit even though circuit B is still up?  Keep in mind that you cannot create a PBF rule for the ping application as far as I know. ... View more

Hello all, I was wondering if a certain scenario is possible through a Palo Alto PA-3020.  Say we have a single ISP with an internal NAT rule pointing to internal server A that is accessible by anyone in the outside world.  If server A ever goes down (or we take it offline), the internal NAT rule will failover to another internal NAT rule pointing to server B.  These two servers are not load balanced nor are they accessed at the same time by the outside world.  The same external IP address will be used to access whichever server is online but again never both at the same time and of course both servers have different internal IP addresses in the same subnet. I'm thinking this would be accomplished with two NAT rules and one or two PBF rules.  What I am trying to figure out is how the Palo would know to use the other internal NAT rule if server A goes down.  Is something like this possible? ... View more

The last few weeks I have noticed a large amount of traffic on the Network Monitor coming from IPSec-ESP.  I moved several VPN tunnels off our old WatchGuard to our Palo Alto PA-3020 around the time this started.  When I click on the application itself to filter it I see that it cannot identify anything about the traffic.  Is this normal?  Shouldn't it at least be able to identify the source or destination of the traffic? ... View more

I have a URL filtering policy set to block the social networking category which of course includes Facebook.  I need to allow the users that are assigned to this filtering policy access to a single Facebook page along with the pages that correspond to this single page.  I tried the link below with no success and of course I tried to add the specific URL to the allow list in the filtering policy which also did not work.  The weird thing is I never see an actual response page when I have the page blocked.  I get the following error: Secure Connection Failed An error occurred during a connection to www.facebook.com. SSL received a record that exceeded the maximum permissible length (Error code: ssl_error_rx_record_too_long) For the security policy itself I have dns, http (filter) and ssl allowed (I've also had web-browsing, with the http(filter) removed, and facebook listed as well) under application and services set to application-default.  Do I have something configured incorrectly?  I feel this should be something simple that I am missing. How to Allow a Single Facebook, YouTube or Twitter Page ... View more

Hello all, I am trying to set up WAN failover on a Palo Alto PA-3020.  I used the document at the bottom of this post.  When I unplug the interface that is set up in the PBR, it switches over to the secondary ISP like it is supposed to.  The problem is the Primary-NAT policy is still active so traffic doesn't pass because the Backup-NAT never takes effect.  If I manually disable the Primary-NAT rule then I see traffic able to leave the Palo Alto.  I noticed the document is for PANOS 3.1 but it doesn't look like much has changed as far as settings go.  Does this setup still work for 6.0+?  If so is there something I am missing so the Backup-NAT rule takes over?  I didn't see anywhere that tells the NAT policies themselves to failover. Dual ISP Branch Office Configuration ... View more