About myrdin

thanks RFalconer.    after a lot more reading, i found out that Bonjour sets ttl=1 by default so crossing a router, although possible, will decrease ttl to 0 and the packet it is discarded. This is by design.   Multicast routing although possible, it will not serve this purpose hence it won't work.   The only way to handle this is to use a bonjour gateway which is a feature some vendors offer, like Aruba or Cisco Meraki.      ... View more

thanks reaper, that is correct, the group mapping is specifically created to map that AD group ... View more

thanks guys.   I thought about it and i came to the conclusion that the Palo is slow already as it is, if i even am to add a NAT to translate WITHIN the LAN every packet to another internal segment, it will catch fire.   I found an article that explains how to create a zone protection and i will apply on the trust zone only so to avoid enabling the bypass globally, and in the zone protection to avoid dropping traffic because of the syn sequential number problem   thanks to all pointing in the right direction   ... View more

also guys is it possible to check (and how) somewhere whether a packet is being discarded because of the asymettric problem reason, because from the traffic logs i cant see anything being discarded   thanks ... View more

Hi,   thanks heaps for your answer.   Yes so router 2.2.2.2 has default route to 2.2.2.1, host on the 3.3.3.0/24 network have the right gateway. Please note that with a "dumb" router in which i simply create forward rules to 2.2.2.2 everything works. Basically the dumb router is configured exaclty as the Palo, but there is obviously something the Palo is doing more that is preventing that to work.   I have other destination NAT rules that are working on the same PALO (i know you have to define untrust/untrust in the destination NAT). The difference is that the destiation NAT that are working are going to an network directly attached to the PALO. In example:   1.1.1.1 PALO 5.5.5.1 ---- 5.5.5.2 host   the desintation NAT 1.1.1.1 to 5.5.5.2 WORKS in the PALO   what it does not work is the one originally posted so 1.1.1.1 PALO 2.2.2.1 --- 2.2.2.2 DUMBROUTER 3.3.3.1 ---- 3.3.3.2 Forwarding 1.1.1.1 to 2.2.2.2 which in turns forwards to 3.3.3.2 does not work. With a dumb router instead of the PALO which forwards packets received to 1.1.1.1 to 2.2.2.2 which in turns forward to 3.3.3.2 it works.   I am suspecting the PALO is not forwarding the same way the dumbrouter does and the patckets that the DUMBROUTER receives are different from what a "normal" router does.   Unfortunately i cannot share the config. If you have any other ideas, i can put in my queue but i have very limited time for testing as when we switch to the PALO we have very limited time to make things working before reverting back   but thanks     ... View more

thanks all you guys heaps.   I will try the U-TURN, i didnt know i would need this kind of configuration in an asymetric routing situation.   Would this explain the fact that ping was passing but not https connection? Is that because https will start a tcp handshake and ping does not use TCP (so no ACK etc)?   I can troubleshoot via the monitor but i dont know a way to sniffer the packets via ssh, is there a troubleshooting guide somewhere? or do you guys can give me some commands i can use? I essentially need to sniffer the NAT translations to see whehter it is hitting a NAT rule it shouldnt and actually see the traffic at very low level on that LAN interface,   thanks heaps ... View more

Sorry for the very late reply and thanks for your answers. I will give it shot. ... View more