About andreb

I have seen and followed the Reference Architecure guides and they are very helpful. When i was testing it out, i had a VM-100 license, i was pretty sure it limited me to two Virtual Routers, but this comparison tool, says it allows 3. Can you confirm it is 3? The only reason i ask, is we have a customer that deployed their VM-Series with a Untrust, Trust and VPN segments, and three Load Balancers. A Load Balancer on each segment.  So with that i was thinking it would be best to have a Virtual Router for each segment so that the Probes from the Azure Load Balancer are routed back to the LB. Anyways, if you are able to confirm that the VM-100 supports 2 or 3, that would be great.   Thanks, ... View more

I'm not sure where you are testing from but if you are initiating your test from the Internet to access the servers on trust2, did you create a NAT statement on the Palo Alto for the traffic to allow it to be routed over the Internet? Otherwise, also confirm the subnet mask you put on the Trust2 interface. Make sure you used a /24 (or whatever the mask is for the entire subnet) as opposed to just the /32. If you use the /32 the firewall won't know how to get to that subnet. ... View more

Check the route table on the Web Server.  I have found that even though you create a route in the route table for the subnet, the route table directly on the web server will still have it's default route pointing to the IGW. If this is the case, this explains why the return traffic from the web server is not showing in the firewall logs. ... View more