About carlebert

We're still on 4.1.8, as a workaround I just run "dsa.msc /servers=x.x.x.x" where x.x.x.x is the IP of a DC.  Seemed like it was more DNS related than IPv6 from when I looked at it but I suppose specifying an ipv4 address would solve either, glad to hear they put a fix in for it.  ... View more

Think you may be trying to solve this from the wrong piece of infrastructure.  I'd suggest focusing on the client side and narrowing down why the ethernet connection isn't preferred to the WLAN connection without any metric adjustments.  When the routes look like they flip back and forth, do you see their ethernet dropping connection in the event logs on the laptop or on your switches?    This might not fit your particular situation, but we only use HP laptops which have an option in the BIOS for LAN/WLAN switching which disabled wireless automatically when an ethernet connection is detected.  I'm pretty sure our Help Desk people set this on all of our laptops to avoid this exact issue. ... View more

We tried putting in the replacement 850s on Friday night, and they both went non-functional within a few seconds of having production traffic passed through.  It was identical symptoms to the previous units, the first unit passed traffic for a few seconds, unit goes non functional, passive node becomes active for a few seconds then also goes non functional.   I don't think these units are undersized-  We were running on 3020s before this and even right now we have a 5% session table utiliziation,  new cps rate generally around 200-300, dataplane usage CPU usage averaging at about 25-30%.  However looking at our performance stats in Solarwinds, our CPU usage was actually lower on the 850s then it is on the 3020s.   We're about to hit a 10 day change blackout window with the beginning of a month so unfortunately I won't be able to test anything anytime soon, so now we're just entirely at the mercy of support. ... View more

PA sent us RMA notices yesterday afternoon without any word directly from support.  After pressing our regional guys the engineers said our units both had high "U17 values" which apparently means something wrong with the amps usage.  We received the replacements this morning but we likely won't try production until tomorrow evening. ... View more

Just wanted to chip in and say I had the same issue with a 220 (not in a HA config) a while back at one of my sites.  We tried everything we could think of as far as ensuring nothing on the PA was interfering with it, eventually I tried adding a rule to force it through a secondary WAN connection with PBF and the site loaded just fine.  Unfortunately I don't have the logs from that incident anymore and when I went to see if this was still the case the site now works with both ISPs there.  So in my case it likely was an issue on the ISP side (Airespring who was using Sprint's network I believe). ... View more

We were on 8.0.7, and then before we tried putting them in production last night moved them to 8.0.9. ... View more

Bit of a non update update-  We suffered another outage on 4/16 during business hours, 4/17 during the early morning and then at that point we just moved back on to our old 3020.    Basically after multiple calls to support and reaching out to our regional sales guy I finally got a response back Tuesday afternoon.  The tech said he stopped his root cause analysis because the serial numbers from the tech support files I uploaded were the same.  First, they absolutely weren't, and second, even if that was the case, why not continue with analyzing the one file instead of just putting the case on hold?   We uploaded fresh tech support logs yesterday morning, only to be told we again sent the same serial # logs in, and then to have support email us 20 minutes later stating they did receive the new logs and would begin analysis.  We didn't have the core files available from the last crash so we decided to put the 850s back in production last night to see if they would crash again and they did.  So we got a good sent of logs sent in this morning.   We're now basically 1 week into an outage, the only reason we're up is because we had old hardware available.  I had to stomp my feet a bit with support to get Threat/AV temporary licensing for the 3020 but at least they came through on that I suppose.   This is the second major issue we've had with the 850s, the first one was here:  https://live.paloaltonetworks.com/t5/General-Topics/PA-850-Default-MTU/m-p/197124   This also tacks on to the PA-200 fiasco which I posted about here:  https://live.paloaltonetworks.com/t5/General-Topics/PA200-Failures/m-p/75159, which was nearly a year before PA said yes we have some bad hardware, and here's how to check.  By the time PA announced an official recall we had RMA'd 15 PA-200s, and after the recall RMA'd another 12 units before the bad ones crashed on us.   All of this is incredibly frustrating because despite support, when the PA firewalls are working they really are great appliances.  ... View more

That's correct, running 7.1.7.    I did have some promising luck testing just a little bit ago.  While still on 8.0.5, I initially lowered the MTU to 1300 and the traffic started passing like normal.  So I backed the MTU down from 1492 by 8 until I got it working at 1448.    I then removed the 1448 MTU, and upgraded to 8.0.6.  When the firewall came back up my remote switch was able to authenticate without any issue.    Unfortunately I'm in a change blackout now until the second week of December, so I won't be able to put them back in to production until then and know for sure.  At this point I'd rather not mess with MTU's if I don't need to, so I'll likely roll with 8.0.6 on them. ... View more