About Sjoerd

We have a PA3050 in a very simple setup. 1 outside interface and 2 inside interfaces (aggregated).    A few times a week our clients complain about performance. During this time the firewall is generating 1Gb throughput (flat-line).   However, the throughput on the 3 interfaces combined together wont reach the 500Mbit.   Can someone explain what this throughput exactly is and why its higher than our interface statistics?       ... View more

We've a PA-3050 up and running for over a year now. It is configured with an agregated interface with LACP enabled (mode active, transmission rate Fast). These interfaces are attacheced to a procurve 5406 where the interfaces on the procurve are configured as a trunk of the type lacp.   This was running fine till now. Last 3 days the connection on the aggregated interface was gone for about 10 minutes. During this period the system log is filled with these kind of messages:   lacp-up,ethernet1/1,0,0,general,critical,LACP interface ethernet1/1 moved into AE-group ae1 lacp-up,ethernet1/2,0,0,general,critical,LACP interface ethernet1/2 moved into AE-group ae1 nego-fail,ethernet1/2,0,0,general,critical,LACP interface ethernet1/2 moved out of AE-group ae1 nego-fail,ethernet1/1,0,0,general,critical,LACP interface ethernet1/1 moved out of AE-group ae1   I found this article, and this seems to be the case. (the  l2ctrld.log is filled up with these messages). However: I have no idear how to fix this.   Procurve: show lacp local LACP Local Information. System ID: 001ffe-854700 LACP Tx Rx Timer Port Trunk Mode Aggregated Timer Expired ---- ------ -------- ----------- ------ -------- A3 Trk2 Active Yes Fast No A4 Trk2 Active Yes Fast No   show lacp peer LACP Peer Information. System ID: 001ffe-854700 Local Local Port Oper LACP Tx Port Trunk System ID Port Priority Key Mode Timer ------ ------ -------------- ----- --------- ------- -------- ----- A3 Trk2 d4f4be-407901 16 32768 48 Active Fast A4 Trk2 d4f4be-407901 17 32768 48 Active Fast   Palo Alto:  show lacp aggregate-ethernet ae1 LACP: ********************************************************************************** AE group: ae1 Members: Bndl Rx state Mux state Sel state ethernet1/1 yes Current Tx_Rx Selected ethernet1/2 yes Current Tx_Rx Selected Status: Enabled Mode: Active Rate: Fast Max-port: 8 Fast-failover: Disabled Pre-negotiation: Disabled Local: System Priority: 32768 System MAC: d4:f4:be:40:79:01 Key: 48 Partner: System Priority: 18176 System MAC: 00:1f:fe:85:47:00 Key: 291 Port State -------------------------------------------------------------------------------- Interface Port Number Priority Mode Rate Key State -------------------------------------------------------------------------------- ethernet1/1 16 32768 Active Fast 48 0x3F Partner 3 0 Active Slow 291 0x3D ethernet1/2 17 32768 Active Fast 48 0x3F Partner 4 0 Active Slow 291 0x3D Port Counters -------------------------------------------------------------------------------- Interface LACPDUs Marker Marker Response Error Sent Recv Sent Recv Sent Recv Unknown Illegal -------------------------------------------------------------------------------- ethernet1/1 390044 11674573 0 0 0 0 0 0 ethernet1/2 390048 11674600 0 0 0 0 0 0 ... View more

I have a Palo Alto 820 up and running, and one of its roles is to publish an terminal server (on its default port3389, the Terminal Server have an 2 factor authentication mechanism.)   I see lots of connections, and i would like to block this brute force attempts, so I configured a Vulnerability Protection Profile which blocks threats with host type = server, and severity = high.   I changed the default time attributes of Threat 40021 (MS-RDP Brute Force Attempt) from 8 hits per 100 seconds to 10 hits per 300 seconds (since I see approximately 3 attempts per minute from the same IP for a long amount of time). I left the aggregation criteria to its default (source-and-destination)   However, I’m not able to trigger this threat. I did 20 failed logon attempts within a minute or 2, and after this I was able to connect successfully.   So: How can I stop these brute force attacks? Further more: What happens if this would have worked? I guess the IP address of the attacker gets blocked for a specific amount of time. Where can I see these blocked IP’s? And is it possible to (manually) unblock this IPs?   ... View more

One of the applications (a default one in the Palo Alto) sometimes connects over an other port than the defined standard port for the application. Since I defined the plicys service as 'application default', this traffic gets blocked.   Its the application 'magister', which has a standard port of tcp,443 but sometimes connects over 943 & 4502.    The applications user manual (dutch, chapter 3.5) says this ports must be opened for optimal usage, otherwise the application can work slow.   Can i change this application in the firewall? Should i ask Palo Alto to change this? Should i create a custom application?   Thanks in advance!     ... View more

I have a router with 2 VLAN’s. The router is connected to a PaloAlto and behind this PaloAlto I have a server witch serves DHCP. The VLAN interfaces on the router are configured with a helper address to the DHCP server.   We would like to remove all servers (and go fully cloud based). I decided I want the PaloAlto to serve the DHCP function. So: I should define the 2 DHCP scope’s of the routed VLANs to the interface connected to this router. However: It seems I’m restricted to only 1 IP scope per interface. Can I work around this issue?   Side note: I’m not able to attach the routed VLANs directly to the PaloAlto cause off its maximum MAC entries. ... View more