About mikand

Im looking for those with reallife experience from running site-to-site VPN with PA devices both pro (good) and con (bad) stuff that might float up to the surface.   How is the reliability, how is the performance, how is the troubleshooting (if any) etc?   For example looking at this test http://blog.webernetz.net/2016/07/26/palo-alto-vpn-speedtests/ using PA-200 it shows an average of (give or take) 198-271Mbps (depending on cipher being used) with IPsec while the datasheet for PA-200 says 50Mbps IPsec.   Can you assume the same (4-5x compared to the datasheet numbers) for lets say the PA-3000 and PA-5000 (and while we are at it the PA-7000 too) series who in the datasheet says 500Mbps (PA-3000) for IPsec (that is this would actually mean it (PA-3000) would be able to handle 2-2.5Gbps of IPsec in other terms "wirespeed" on a 1Gbps full duplex uplink)?   Does perhaps PA themselfs have some numbers that can be provided in this community forum or for that matter any of the forum members who might have somewhat fresh numbers mainly on the performance figures and which ciphers and PA-model you were using?   Also are there any performance recommendations (when it comes to IPsec and PA) other than the obvious one to enable "Adjust TCP MSS" as described in https://live.paloaltonetworks.com/t5/Management-Articles/IPSec-and-tunneling-resource-list/ta-p/67721 ? ... View more

IPsec is the obvious one but lets say you have already taken care of the protection of the traffic, I failed to see if the PA devices for example supports GRE tunneling (basically for performance reasons I would just like the tunneling itself, not the encryption).   If not, any of you who might know if GRE (or similar) is even on some kind of roadmap? ... View more

With PA-200 there is a command similar to:   set system setting fan-mode auto   in order to throttle the onboard fan(s) so it doesnt rev up to max rpm and stays there as it normally might do.   But this command doesnt seem to exist for the PA-500 series or am I missing somthing here?   All I could find is (output from: show system environmental):   ----Fans---- Slot Description Alarm RPMs Min RPM S0 Fan #1 Operational False True 1 S0 Fan #2 Operational False True 1   Doesnt seem to even detect a RPM, the sound can confirm the fans are operating... ... View more

Today there are various options to achieve UserID using PaloAlto Networks devices:   - Install agent on AD-servers to tail the local security log to pick up which userid uses which ip. - Install agent on remote servers that will tail the security log of one (or more) AD-servers (variant of the above - will bring you more network traffic but at the same time you will avoid installing 3rd party software on your AD-servers). - Let the PA device do the above. - Variant of all 3 above is to tail other logtypes to pick up a relation between userid and sourceip (MS Exchange logs, various other textbased logs etc). - Using WMI (either from agent or from PA device) to verify directly towards the computer who is logged in. - Install TS-agent which will define which userid uses which portrange when using a terminal server.   Any other method that I might have missed?   What I wonder is if the following two use cases have been fixed and in which version (like any differences regarding UserID between PANOS 6.x and 7.x?):     Use case 1:   More than one user is logged in to the same client computer (example one user in front of the computer and one user (lets say supportpersonel) thats logged in remotely, or for that matter one user is logged in (and locked screen) but now a second user arrived and used "switch user" - that is second user login (and get his/her own screen) while the first user is still logged in) - how does PA UserID handle this today?   If I recall it correctly previously a single sourceip (except for when TS-agent is used on terminal servers) can only have a single userid connected to it.   This gives that the latest userid will always overwrite the previous userid (like if someone RDP into the client workstation that RDP user will be identified in UserID and the original user is now no longer identified by UserID).     Use case 2:   A single user is logged in to 2 or more computers at once. Lets say the client workstation and then login to some VDI on a terminal server. Will both ip-addresses be valid for the current userid or wil it be similar to as above that latest login is the valid one and previous ip-address associated with this userid is now overwritten?     Bonus question(s):   Are there any up2date whitepaper regarding UserId when it comes to best practices but also what it can (and cannot) do?   For example how do UserID today identify that a user now logged out of his/her computer(s)?   If use case 1 and 2 are still issues, are there any work in progress to fix this or recommended workarounds? ... View more