About OtakarKlier

OtakarKlier

Hello, Yes you can use the PBF rule to get traffic down one tunnel rather than the other. Please make sure to use the monitor: And use an IP address on the other side of the tunnel for the monitor. Remember that PBF takes priority over the default router, so you have to disable this if the tunnel is down otherwise dynamic routing wont switch the traffic to the proper path. Regards,

OtakarKlier

Hello, Yes you can use the PBF rule to get traffic down one tunnel rather than the other. Please make sure to use the monitor: And use an IP address on the other side of the tunnel for the monitor. Remember that PBF takes priority over the default router, so you have to disable this if the tunnel is down otherwise dynamic routing wont switch the traffic to the proper path. Regards,

OtakarKlier

Hello, I would also recommend taking a screen shot of the denied traffic logs, and comparing it to the security policy its supposed to hit. Regards,

OtakarKlier

While I have not had to do this. The articles go into this using NAT when you have the same subnets on the both sides.

OtakarKlier

Hello, Please check out these articles and see if they help out. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLTlCAO https://live.paloaltonetworks.com/t5/general-topics/overlapping-subnets-in-virtual-router-and-nat/m-p/199902#M59180 Regards,

OtakarKlier

Agreed. Hope you got the info you needed.

OtakarKlier

Hey no judgement here, I've done worse (just ask my wife) ;). We all over look things especially when we are all overworked. Glad you got it going!

OtakarKlier

Hello, I would say just go with the several built in lists. Stay with more behavioral based approaches along with a secure DNS provider. https://live.paloaltonetworks.com/t5/learning-articles/working-with-external-block-list-ebl-formats-and-limitations/ta-p/58795 Regards,

OtakarKlier

Hello, So lots of hops and different devices there. My mind goes to asymmetric routing somewhere. I would say follow the packet paths and see where they lead. BTW good move on migrating away from the Forti's. Regards,

OtakarKlier

Hello, So I am a huge proponent of the K.I.S.S principle. What are you load balancing DNS traffic? Have you tried to remove the Load Balancer from the equation? I have seen a lot of issues in the past with load balancers and asymmetric traffic return, etc. Regards,

OtakarKlier

Hello, How are the two data centers connected? Just curious as to why you need the NAT? Regards,

OtakarKlier

Hello, The definitions are not installed. They look to only be downloaded. Install them and see what happens. The predefined EDL's dont have to be added. They will appear automatically. Regards,

OtakarKlier

Hello, In the drop logs, what is the reason it gives for the drop traffic? Regards,

OtakarKlier

Hello, Please contact your sales team. Regards,

OtakarKlier

Hello, In the policy, make sure you are logging the traffic. Also when it cones to UDP traffic, the session stays open so it might not show in the traffic logs immediately. I would suggest checking the Session Browser as that is showing all active sessions and is better for looking at UDP traffic. However the traffic logs should show why the session ended and the policy that allowed/blocked the traffic. Regards,

Date Registered	‎07-17-2015 09:00 AM
Date Last Visited	yesterday
Total Messages Posted	2,036
Total Likes Received	414

Online Status	Offline
Date Last Visited	yesterday

About OtakarKlier

Re: Prioritizing an BGP route over other BGP routes for IPSec tunnel traffic redirection

Re: Defining metrics for routes learned through BGP

Re: Custom Category traffic flow issue

Re: Many-to-Many NAT (Both Direction)

Re: Many-to-Many NAT (Both Direction)

Re: ssl forward decryption not work with URL category (proxy-avoidance-and-anonymizers )PAN 10.0.5

Re: Got Questions? Get Answers!

Re: dynamic external lists sources

Re: dynamic external lists sources

Re: Tips to block Yahoo Mail but not other parts of Yahoo

Re: HELP: HOW TO BLOCK BITTORRENT ON PALO ALTO?

Re: Default Outbound Security Policy

Re: Change management ip of cluster nodes.

Re: SolarStorm attack - Share your thoughts

How to setup No-IP Dynamic DNS on Palo Alto PAN-OS 9.0.12

Re: Prioritizing an BGP route over other BGP routes for IPSec tunnel traffic redirection

Re: Defining metrics for routes learned through BGP

Re: Custom Category traffic flow issue

Re: Many-to-Many NAT (Both Direction)

Re: Many-to-Many NAT (Both Direction)

Re: Blocking external IP addresses and blacklists

Re: dynamic external lists sources

Re: Blocking external IP addresses and blacklists

Re: VMware Horizon View via Load-Balancer

Re: DNS Resolution with global protect.

Re: Many-to-Many NAT (Both Direction)

Re: dynamic external lists sources

Re: Packet capture drop stage shows production traffic

Re: Got Questions? Get Answers!

Re: Packet capture drop stage shows production traffic

Network Security

Cloud Security

Security Operations

About OtakarKlier