About KyleFreise

How would you go about doing that, if you can't log in?  I'm having the same issue.  I haven't logged in to the CLI lately, and now it's not letting me in at all.  I'm also unable to log in in single user mode.   ... View more

Can you provide details of what you are trying to accomplish?   I use bi-directional NAT rules to redirect different internal subnets to specific ranges of public IP addresses.   I do not bind any NAT rules to interfaces, but rather zones. ... View more

Hi,   First of all the mac addres in a HA cluster  are virtual so it'll be 1 ip per 1 virtual mac address,  https://live.paloaltonetworks.com/t5/Learning-Articles/How-to-Calculate-a-Virtual-MAC-Address/ta-p/55573 During the failover the passive firewall send gratuitous arp that updates the mac table in the switches, but the mac address is the same so there's not need to clear the arp table in the layer 3 devices or your bgp peers. Also its possible to achieve a subsecond failover in bgp active/passive if you enable graceful restart on both BGP peers, https://live.paloaltonetworks.com/t5/Management-Articles/Unable-to-Achieve-Sub-Second-Failover-Times-with-BGP-for-Active/ta-p/62006 Moving to HA A/A is a big step and will require more planning regarding session setup, session owner, distribution method...   Regards, Gerardo. ... View more