About ClarkeMorledge

Is it possible to turn off DNS lookups when performing packet captures on the dataplane?   I was hoping to run some pcaps, without taking up too many unnecessary resources through DNS lookups.   Thanks. ... View more

I have a virtual wire configuration, on an active-passive firewall cluster, where I am running a routing protocol through the virtual wire, with BFD (Bi-Directional Forwarding detection) attached to that routing protocol. In the virtual wire mode, the firewall is NOT participating with the routing protocol, and also, the firewall does not participate in BFD itself.  It only allows BFD to pass through the firewall.   In the event that the routing protocol fails to have good connectivity through the firewall, I want to use BFD such that I can play routing tricks on the upstream and downstream routers, to force a failover condition.    It works well, except that sometimes the firewall is dropping BFD traffic, when it gets loaded down, and a failover condtion is prematurely triggered. Is there a mechanism by which the firewall can be configured to allow BFD traffic to pass through unmolested?   Is there some way to whitelist BFD, or put in some type of exception, for the IP addresses that actually do participate in BFD?   Thanks.   ... View more

I have a pair of 5220s configured with HA1, HA1 Backup, HA2,  and HA2 Backup links in use.  All HA links show to be up and running. I have left all of the other knobs for tuning link and path monitoring off, taking all of the defaults. No preemption, etc. I am running in an Active/Passive configuration.   When I disconnect HA1 and HA1 Backup, at nearly the same time, the Passive unit becomes Active, but the Active unit remains Active.     Then when I went further to disconnect HA2 and HA2 Backup, at nearly the same time, and still, the old Active unit remains Active.   Is this expected behavior?   Is there any way to monitor the links on the HA ports themselves?  I do not see that as an option in the GUI.   Thank you.   Clarke ... View more

I have some 5220s, but I am assuming this question would relate to other platforms, as well.   On the 5220s, is it possible to look at the last x number of log messages, depending on the log type, or a PAN OS equivalent to the Unix "tail -f logfile," for looking at log output in real time?   Thanks. Clarke ... View more

I am trying to figure out how to determine the link and transceiver status on the AUX ports on a PA 5220, when used in HA1 mode.   I know that via the CLI, you can determine the transceiver status with the following command, but I do NOT see the AUX ports listed:   show system state filter sys.s1.p*.phy   Is there another CLI command to show link and transceiver status on the AUX ports?   Thanks. Clarke   ... View more

I am having trouble trying to get a PA-5220 to commit, when attempting to configure HA1, not on the  ha1-a default interface, but rather on aux-1.  The same applies when configuring HA1-Backup to use aux-2.   I can commit with this config, under high-availabilty:   set deviceconfig high-availability group 1 peer-ip 192.168.0.2 set deviceconfig high-availability group 1 peer-ip-backup 192.168.2.2 set deviceconfig high-availability group 1 mode active-passive passive-link-state auto set deviceconfig high-availability group 1 election-option device-priority 90 set deviceconfig high-availability group 1 election-option timers recommended set deviceconfig high-availability group 1 state-synchronization enabled yes set deviceconfig high-availability group 1 state-synchronization transport ip set deviceconfig high-availability interface ha1 port aux-1 set deviceconfig high-availability interface ha1 ip-address 192.168.0.1 set deviceconfig high-availability interface ha1 netmask 255.255.255.0 set deviceconfig high-availability interface ha1-backup port aux-2 set deviceconfig high-availability interface ha1-backup ip-address 192.168.2.1 set deviceconfig high-availability interface ha1-backup netmask 255.255.255.0 set deviceconfig high-availability interface ha2 ip-address 192.168.1.1 set deviceconfig high-availability interface ha2 netmask 255.255.255.0 set deviceconfig high-availability interface ha2 port ethernet1/19 set deviceconfig high-availability interface ha2-backup port ethernet1/2 set deviceconfig high-availability interface ha2-backup ip-address 192.168.3.1 set deviceconfig high-availability interface ha2-backup netmask 255.255.255.0 set deviceconfig high-availability interface ha3 set deviceconfig high-availability enabled no But if I change the last line:   set deviceconfig high-availability enabled yes   I get the follow error when I try to commit:   Commit job 19 is in progress. Use Ctrl+C to return to command prompt ... High-availability ha1 IP information will use interface IP information if port is 'aux-1'. Please remove IP information from ha1(Module: ha_agent) Error: HA1 Port is not configured Error: ha configuration error (Module: device) Commit failed If I drop back and use ha1-a for ha1, and ha1-b for ha1-backup, it commits just fine.   Any ideas as to why this is not working?   Thanks.   Clarke     ... View more

With a pair of 5220s, how does one set up HA2 on a port that is not HSCI, for an Active-Passive HA environment?    When I go to configure HA2, either with the GUI or CLI, the only interface I can choose is the HSCI port.  But I do not have the quad transceivers, nor do I yet require the use of the HSCI bandwidth capabilities.  Here is what the CLI tells me:   admin@PA-5220# set deviceconfig high-availability interface ha2 port     hsci     High Speed Chassis Interconnect (HSCI) dedicated for HA2 and HA3 interfaces   <value>   <value>   admin@PA-5220# set deviceconfig high-availability interface ha2 port aux-2   Server error :   ha2 -> port 'aux-2' is not an allowed keyword   ha2 -> port 'aux-2' is not a valid reference   ha2 -> port is invalid   I would like to use aux-1 for HA1, which configures as expected. But HA2 will not cooperate for use the aux-2.  As an alternative, I could use a 10gig ethernet port for HA2, but this still is not available to me.   Any solutions?   Clarke Morledge College of William and Mary ... View more