About cmateam

cmateam · ‎07-16-2015

Company ended up going with another vendor all together. Have one more set to swap out - but washing we're washing our hands of Palo Alto. Sadly I can't recommend them to anyone. Based on their customer support (lack of) in trying to help resolve the issue. It seems like it's the bottom dollar, not the customer they care about.

cmateam · ‎03-16-2015

Running PA-2020 with 6.0.6. And 6.0.2 on another set.

cmateam · ‎03-16-2015

I'm also struggling to keep committed to PAN when standard support renewals, threat prevention, and URL filtering costs me just a little less than other FW products (with 3 year 24x7 support) that provide the same feature sets, faster hardware, etc. From a non-profit perspective it seems like a no-brainer to switch platforms.

cmateam · ‎03-16-2015

thanks jperry1. When will 6.1.3 be released? I have a support case open at the moment - which was opened on Friday. No action has been taken at this point. Its even stranger that we have two sets and experiencing the same issue on both. Wonder if people just assume they are slow and don't say anything, or are they truly not having problems.

cmateam · ‎03-13-2015

I agree...so interesting that you see similar issues on 5.0.11. I am on 6.0.6 - they were saying 6.1.x potentially fix the issues. Hmmm guessing not. 5.x.x. seemed to be bearable and the occasional failure was ok, but moving forward it has been horrible.

cmateam · ‎03-12-2015

Just got off the phone with a Sales Engineer and Sales Rep and he is going to look into the issue, but believes that the upgrade to 6.1 resolves these issues with poor commit times and failures at commits. He is going to research that. It would be helpful if they just communicated that, rather then trying to sell you something. I'll let you know what I find out.

cmateam · ‎03-12-2015

Per this discussion:PA-2000/4000 trade-in I am also caught in the same boat. From what I recall PAN-OS-5 worked ok on the PA-2020's. Because of all the issues I am experiencing with OS 6 and the inferior product, I am wondering if anyone had success downgrading their OS 6 back to 5. I know I have just over a year before that OS is EOL, but it also buys me a a year of hardware that is actually going to function better than it is now. It gives me a year to get my ducks in a row and buy different firewalls that will last more than 2.5 years too. I was just curious if you had any experience, but I will likely have to open a support tickets to make sure there are no more gotcha's.

cmateam · ‎03-12-2015

@dieterb and all. I too received a call yesterday from a Palo Alto Networks Business Development representative and they were asking about my PA-2020 experience and I mentioned that particularly after upgrading to PAN OS 6 that commits failed somewhere between 60% to 75% of the time and it took about 15 to 20 minutes to actually commit things - which becomes really frustrating when you only need to commit one change. I was then offered by the rep (the customer care upgrade program - there is nothing Customer Care about this!) this idea of being able to upgrade for new hardware (the PAN-3020) - they would give support and other license credit to move over to the new platform. It was also eluded to that PAN knew of some hardware defect/issue (whether it is a inferior management plain, RAM, or something else? I didn't get any other details.) that caused these issues and wasn't going to be resolved with a simple OS patch. This lead to me explaining to them that they can't expect me to upgrade when we are only a little bit under halfway of the life cycle we expect from the devices. I work for a non-profit that doesn't have endless amounts of money to fix a issue that Palo Alto created (I spoke with our VAR and it will cost us $65k to $70k to upgrade 4 firewalls we have - that are only 2.5 years old). Needless to say I am quite frustrated and ready to cut my losses and buy firewalls that are 1/6th the cost of these things that have like and/or similar features. PAN is a leader in these new features, but they aren't the only ones doing it. So I am waiting to hear back from the VAR/PAN regional rep, and yet to hear from them about what are my options. It's also interesting that my support renewal is coming up next month, so this might be the open door to jump ship. As @dieterb said, a remedy, or a upgrade for the customer with no cost to the customer would be the right approach from PAN, but they are more interested in making the customer pay for the inferior product they created and sold. Also to note: In the PAN-OS 6.0 document, I did not see anything about the PA-2000 or 4000 series not being supported. This seems that either they didn't test their OS out well enough, or knew there was issues, but allowed people to install anyway. Seems a little fishy to me.

cmateam · ‎09-30-2014

I've not pursued this any further as requirements for the project has changed. I spoke more with Cisco Meraki, as it seem there configuration options are less feature rich as the PAN's, and is somewhat confusing, so I've not resolved this. Sorry.

cmateam · ‎07-11-2014

You are correct. I just installed the license and its wanting me to activate - which can't be done until the appliance is in a suspend state. Thanks!

cmateam · ‎07-10-2014

Thanks! We just purchased the license and will hopefully implementing it this weekend. So this explains why I don't see that option. All this is helpful - it sounds like going the PAN-DB route is good for our situation. Thanks all!

cmateam · ‎07-10-2014

Thanks - So I'm a little confused. Is the BrightCloud only use for the trail license, and then when you actually buy its a PAN-DB license for content filtering? I don't see any options under the Trail license to select the Database Download location. This is what I see. This was in reference to your link: How to Install and Activate PAN-DB for URL Filtering

cmateam · ‎07-09-2014

I am currently using a trial of the URL filtering license and have made the purchase for the full license. Does anyone happen to know if it's a seamless transition from the expired trial to the full license with out any interruption? To initially enable the service I had to reboot my firewalls one at a time, It doesn't make sense that I'd have to do that again, but wondered what the experience was in this transition.

cmateam · ‎07-09-2014

I had similar issue, but I also had upgraded to 6.0.2 at the same time. I was using AD DC produced user certificates as a part of the client verification to connect to the VPN. I found disabling the need for the auth on the certs off, and it fixed the problem you described. I haven't had time to open a ticket to see what broke. This affected both OS X and Win 8/7 clients.

cmateam · ‎03-24-2014

Hi all, Has anyone had success establishing a site-to-site tunnel between an PAN firewall and a Cisco Meraki Cloud managed firewall? I've been messing with it for most of the day and have not found much luck. I've added a third party peer on the Meraki, but it doesn't seem to make any connections back to PAN even an attempt to establish the tunnel. I probably should connect with Cisco support to, but wondered if anyone had any configuration on the PAN side of things. Thanks for any help!

cmateam · ‎09-23-2013

Was just having the same problem. Turned out to be a return route as apasupulati suggested in item #3 of his post. Similar setup here in this post: Client VPN traffic and routing over IPsec Tunnel

cmateam · ‎09-23-2013

Traceroute helped identify the problem and reading this post: Accessing all company networks with GlobalProtect client - turns out it was a route that needed to be added on the other side to return the traffic back to the client. Looks like everything is working as expected. cc: @ leonidspect

cmateam · ‎09-20-2013

Here is the screen shots and packet captures. Hope this helps. Packet Captures: Dropbox - PAN (doesn't look like I can upload the packet captures here) this is on the firewall handling the Client VPN traffic) Traffic on FW handling Client VPN traffic Receiving FW

cmateam · ‎09-19-2013

Hi there, Here is our scenario that I am trying to figure out. We have two sites (main office and a rack in a data center) that are connected via PAN-2020's on both sides through a IPsec Tunnel. I am trying to route Client VPN traffic that connects at our main office to go over the site-to-site tunnel to access some web servers there. It seems the traffic goes over the tunnel, but all is marked as incomplete. Below is my config..is it a route metric issue or a routing issue in the Client VPN traffic config? Our VPN clients are obtaining DNS from internal domain controllers. Our web server are defined with internal zones on those domain controllers, that is why I am having this issue. Any help would be appreciated. Can provide additional details as needed. Main Office: Zones: Trust Zone - (192.168.x.x/16) SSL-VPN Zone - (172.x.x.x/24) - no split brained routing (0.0.0.0/0) Site-to-Site Tunnel Routes: Default Route: 0.0.0.0/0 - metric 10 Trust Zone - metric 5 SSL-VPN Zone - next hop 0.0.0.0 - metric 8 All traffic over tunnel to remote zones - metric 5 Security Policies: Trust Zone & SSL-VPN zone to Tunnel - allow all traffic Data Center Rack: Zones: Trust Zone - (10.20.x.x/16) Untrust Zone - (10.30.x.x/16) - were web servers are Site-to-Site Tunnel Routes: Default Route: 0.0.0.0/0 - metric 10 Trust Zone - metric 1 Untrust Zone - metric 1 All traffic over tunnel to remote zones - metric 1 Security Policies: Trust Zone & Untrust Zone to Tunnel - allow all traffic

cmateam · ‎07-25-2013

ukhapre, In our site to site setup, we are not using and Cisco products. Both sides are PAN-2020s.

cmateam · ‎07-23-2013

All, First, please forgive me if this has been asked before, I wasn't able to find anything conclusive with any good explanation. Recently I renewed a couple of web server certificates and in doing so the CA recommended that I use SHA2 with a 256-bit message digest as SHA1 was known to have been cracked and was weak. This lead to some further digging on some of the crypto stuff for the PAN firewalls and noticed that a site-to-site IPsec tunnel I had setup nearly a year ago is using SHA1 (both are PAN firewalls). My current config is: IKE Crypto is using: Encryption - aes128, 3des Authentication - sha1 DH Group - group2 Lifetime - 8 hours IPsec Crypto is using: ESP/AH - ESP Encryption - aes128, 3des Authentication - sha1 DH Group - group2 Lifetime - 1 hours I kinda followed the 'book' based on PAN's documentation from a couple years ago, and some of the details are coming back to me, but what I am wondering if implementing some of the higher encryption/authentication standards can be done by stacking. I believe I can do this on both sides with no problem, but what I am little fuzzy on is the DH group setting and does that need to be adjusted. I found this site that explained the details a little bit more: Help - IBM z/OS Management Facility. Additionally what has been your experience with using AES256 over AES128 for encryption - any performance issues? (IPsec crypto also supports AES128 CCM16). And for Authentication SHA512 over SHA256? Thanks for any help.

cmateam · ‎04-30-2013

Ben, I had mine on 100/full/auto and changed it to auto/auto/auto committed it, and then changed it back to 100/full/up (auto probably would work too). I bet just changing it from auto to up and committing it would work. I did this on the FW and not the router.

cmateam · ‎04-29-2013

I had a similar problem where the WAN link was set to a fixed setting 100/Full/Up and upon upgrade it failed to come up when I failed to that firewall to upgrade the other. I ended up changing it's settings and committing the change which brought the link back up. I then changed it back to the original setting. I upgraded from 4.1.9 to 5.0.4.

cmateam · ‎04-12-2013

Some rogue detection tools can communicate with switch ports and shut those off, assuming switches can understand such instructions. There are tools like Aruba Airwave (I think Dell uses the same product, just branded differently) that supports such things. A NAC type system would be the next thing, but could be difficult to employee in a school setting I'd imagine. @egearhart recommends something similar, but requires you to have cisco equipment it looks like.

cmateam · ‎03-11-2013

coactive, I completely agree. I plan to wait a couple weeks as my work (and of course personal) time does not allow for me to jump right away on this. Probably in April at this point, but unsure. Thanks for the heads up, I'd be curious to know how they go.

cmateam · ‎03-11-2013

I see it available today myself. Was waiting for this one before moving forward from 4.1 to 5.0.3. Those who've upgraded, was their initial setup and config that had to take place from 4.1 or is the upgrade a install and worry about some of the new features at a later time? If that makes sense?

cmateam · ‎02-23-2013

I believe all you need is a user certificate. When going to the certsrv in a web browser, logging in with the user name/password - for us just generates a user certificate.

cmateam · ‎02-20-2013

User certificates were created from Window's Server Cert Authority - we obtain user certs this way https://domaincontroller/certsrv since that is where our certificate authority is as the moment. If you are logged in with the user then they just simply walk through the process and it add's it to their machine. I'm not sure I understand the Gateway cert question, we generated a third party cert and specified both in the portal / gateway this cert for our server cert. I also had to use our internal root cert to handle the user cert authentication.

cmateam · ‎01-17-2013

Ah - very cool. That may be what I need in the next year (network switch upgrade and move to vlans) and for another project here soon at another location. This is good to know for 5.0.x as I am still working with 4.1. Thanks again.

cmateam · ‎01-17-2013

Just out of curious - what are the other ways?

Date Registered	‎04-10-2012 10:51 AM
Date Last Visited	‎08-18-2015 09:07 AM
Total Messages Posted	76
Total Likes Received	7

Online Status	Offline
Date Last Visited	‎08-18-2015 09:07 AM

Strata

Prisma

Cortex

About cmateam