About dsulli99

Hi, I have a question regarding ARP caching and timeout on the Palo Alto platform. Based on the output of the "show arp all" command, it looks as if the "default timeout" is 1800 seconds.  I am doing some work with failover for a cluster inside my firewall, and I wanted to know if there was persistent ARP caching such that a different MAC address can immediately begin ARPing for an IP that is cached on the firewall itself.   I have seen some environments where persistent ARP caching is implemented as security feature to resolve inadvertent IP address conflicts.  Is this sort of feature enabled on the Palo Alto platform?  Does anybody know if this is related to the ARP settings in the output of "show arp all"?  I basically want to make sure that my firewall is configured in a way that a new MAC address can immediately being ARPing for an IP address withouth having to flush a cache or waiting for a cached entry to expire (even if the expiration would occur after a few seconds). I currently have the software version 4.1.6 installed on my cluster (I searched the admin guide for all occurrences of the word ARP and couldn't find the information I am looking for).  I appreciate any guidance you could provide in helping me answer this question. Dan Sullivan ... View more

Hi, Live Community, Can you please tell me whether or not it is possible to execute a command on the other device in PAN-OS, and see the output (without logging into the other device, for example)? Thank-you so much, Dan Sullivan ... View more

Hi, All, I have a hopefully quick question regarding my Palo Alto 5050 firewall pair; whenever I go to log in via SSH, I get a delay of approximately 5-10 seconds before I am actually prompted for a password.  Is this normal?  This is more of a nuisance than anything causing a problem, however it is begining to bother me because I am logging into these devices somewhat frequently.   I seem to remember that when I first set these  up, that I would get prompted immediately.  I took a quick look at the logs and I don't see anything that would suggest why a delay is being caused in my being prompted for a password.   Has anybody seen this symptom before? Thank-you so much, Dan Sullivan ... View more

Hi, Everybody, Does anybody know if there is an equivalent of the "| display set" pipe operator from Juniper SRX Junos in the configuration mode in Pan-OS?  Thank-you so much for your help answering my question. Dan Sullivan ... View more

Hi, Everyone I am sorry I am posting a few questions today I am still learning the PAN-OS platform and this is kind of a basic one; is it possible to tell the MAC address of a local layer 3 VLAN interface?  I can ping it, and verify that the IP address is configured locally on the interface, however the MAC does not show up in the local VLAN interface configuration, nor does it show up in the local ARP table. admin@PA-5050> show interface vlan.3357 -------------------------------------------------------------------------------- Name: vlan.3357, ID: 256 Operation mode: layer3 Virtual router 6045 Interface MTU 1500 Interface IP address: 128.135.245.36/28 Interface management profile: N/A Service configured: Zone: Campus-Facing, virtual system: vsys1 Adjust TCP MSS: no -------------------------------------------------------------------------------- Logical interface counters read from CPU: -------------------------------------------------------------------------------- bytes received                           109824 bytes transmitted                        0 packets received                         736 packets transmitted                      0 receive errors                           0 packets dropped                          0 packets dropped by flow state check      0 forwarding errors                        0 no route                                 0 arp not found                            14 neighbor not found                       0 neighbor info pending                    0 mac not found                            0 packets routed to different zone         0 land attacks                             0 ping-of-death attacks                    0 teardrop attacks                         0 ip spoof attacks                         0 mac spoof attacks                        0 ICMP fragment                            0 layer2 encapsulated packets              0 layer2 decapsulated packets              0 -------------------------------------------------------------------------------- admin@PA-5050> ping host 128.135.245.36 PING 128.135.245.36 (128.135.245.36) 56(84) bytes of data. 64 bytes from 128.135.245.36: icmp_seq=1 ttl=64 time=0.030 ms ^C --- 128.135.245.36 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.030/0.030/0.030/0.000 ms admin@PA-5050> show arp all maximum of entries supported :      20480 default timeout:                    1800 seconds total ARP entries in table :        0 total ARP entries shown :           0 status: s - static, c - complete, e - expiring, i - incomplete interface         ip address      hw address        port         status   ttl  -------------------------------------------------------------------------------- admin@PA-5050> ... View more

Hi, Everyone, I have a question that I was hoping I could recieve some help with;  I am doing an initial configuration of my firewall (I am new to Pan-OS, and I can't seem to ping my upstream router).  I have an 802.1q trunk link coming into my device with a single VLAN on it (VLAN 3357).  When I do a packet capture, I see the hearbeat traffic for the upstream HSRP interface, so I know that at least *some* traffic is traversing the link properly.  I am getting these weird "SNAP Unnumbered, ui, Flags [Command], length 50" logs in a packet capture entry; does anybody know what this means?  Is there any way to do a reverse arp for this mac: 58:8d:09:69:a8:09 to find out what it actually is?  Thank-you so much for your help with this.  I hope you have a wonderful day. admin@PA-5050> view-pcap filter-pcap DRP.pcap reading from file /opt/panlogs/session/pan/filters/DRP.pcap, link-type EN10MB (Ethernet) 06:53:51.635061 IP 128.135.245.35.hsrp > 224.0.0.2.hsrp: HSRPv0-hello 20: state=standby group=1 addr=128.135.245.33 06:53:51.636959 IP 128.135.245.34.hsrp > 224.0.0.2.hsrp: HSRPv0-hello 20: state=active group=1 addr=128.135.245.33 06:53:51.750619 01:00:0c:cc:cc:cd (oui Unknown) > 58:8d:09:69:a8:09 (oui Unknown) SNAP Unnumbered, ui, Flags [Command], length 50         0x0000:  0100 0ccc cccd 588d 0969 a809 8100 cd1d  ......X..i......         0x0010:  0032 aaaa 0300 000c 010b 0000 0202 3c6d  .2............<m         0x0020:  1d00 2304 eebe 0200 0000 006d 1df8 66f2  ..#........m..f.         0x0030:  0e26 c181 8e00                           .&.... 06:53:52.532858 58:8d:09:69:a8:09 (oui Unknown) > 01:00:0c:cc:cc:cc (oui Unknown) SNAP Unnumbered, ui, Flags [Command], length 120 06:53:52.636198 IP 128.135.245.34.hsrp > 224.0.0.2.hsrp: HSRPv0-hello 20: state=active group=1 addr=128.135.245.33 06:53:52.636904 IP 128.135.245.35.hsrp > 224.0.0.2.hsrp: HSRPv0-hello 20: state=standby group=1 addr=128.135.245.33 06:53:53.638757 IP 128.135.245.34.hsrp > 224.0.0.2.hsrp: HSRPv0-hello 20: state=active group=1 addr=128.135.245.33 06:53:53.639619 IP 128.135.245.35.hsrp > 224.0.0.2.hsrp: HSRPv0-hello 20: state=standby group=1 addr=128.135.245.33 06:53:53.750627 01:00:0c:cc:cc:cd (oui Unknown) > 58:8d:09:69:a8:09 (oui Unknown) SNAP Unnumbered, ui, Flags [Command], length 50         0x0000:  0100 0ccc cccd 588d 0969 a809 8100 cd1d  ......X..i......         0x0010:  0032 aaaa 0300 000c 010b 0000 0202 3c6d  .2............<m         0x0020:  1d00 2304 eebe 0200 0000 006d 1df8 66f2  ..#........m..f.         0x0030:  0e26 c181 8e00                           .&.... 07:09:23.116923 IP 128.135.245.36 > 128.135.245.33: ICMP echo request, id 39775, seq 1, length 64 07:09:23.117794 IP 128.135.245.36 > 128.135.245.33: ICMP echo request, id 39775, seq 2, length 64 07:09:24.131794 IP 128.135.245.36 > 128.135.245.33: ICMP echo request, id 39775, seq 3, length 64 07:09:25.132304 IP 128.135.245.36 > 128.135.245.33: ICMP echo request, id 39775, seq 4, length 64 07:09:26.136048 IP 128.135.245.36 > 128.135.245.33: ICMP echo request, id 39775, seq 5, length 64 ... View more

Hi, I have a quick question regarding the insertion of an SFP Module into a Palo Alto Networks 5050.  I have a Finisar FTLX8571D3BCL SFP module that works fine in Ether Port 1/13 (i.e I get link state).  From reading the vendor documentation for this module, I am fairly certain that the module is an SFP+ module. The output of the following command shows the information discerned from the device: sys.s1.p21.phy: { 'link-partner': { }, 'media': SFP-Plus-Fiber, 'sfp': { 'connector': LC, 'encoding': Reserved, 'identifier': SFP, 'transceiver': , 'vendor-name': FINISAR CORP.   , 'vendor-part-number': FTLX8571D3BCL   , 'vendor-part-rev': A   , }, 'type': Ethernet, } The problem I am having is when I try to use the module in one of the SFP+ ports (by just moving it over), it is not working (I do not get a link light).  It only seems to work when I have the module plugged into one of the SFP ports 1/13, for example.  I have a Palo Alto 5050, so ports 21-24 are SFP+. I have attached a full device configuraiton for my current running configuration. From what I can tell both of these ports are configured exactly the same.  Do I need to do something special to get this to work in an SFP+ port?  Could anybody potentially help me shed some light on why I cannot get link state when I move the module from port 13-21? Thank-you so much for your help.  I hope you have a wonderful day. Dan Sullivan ... View more

Hi, I am a new Palo Alto firewall user, however I have been working with firewalls for some time.  I have a couple of quick questions; 1) Does the Palo Alto PAN-OS firewall have equivalent of the "shut"  or "no shut" command to turn an interface on or off? 2) I have an 802.1q trunk link coming into my firewall; this trunk link has multiple VLANs tagged on it; would it be possible for somebody to provide a very basic sample (plain text) configuration of what the the interface (physical, layer 3, subinterface, VLAN) of my device should look like if I want the layer 3 interfaces for these VLANs to live on the firewall itself? Basically I am having trouble getting the link light to light up on the firewall, and I am unsure what is required to have the interface attempt to enter an 'up' state. I am historically used to managing devices from the command-line, however I am struggling a bit because although I have reviewed the CLI administration guide, the guide does not provide configuration examples.  Are there configuration examples available for PAN-OS? Dan Sullivan ... View more