About nanukanu

Hi,   Sorry for the late answer.   Finally we will try to solve using standard BGP attributes:   NO_EXPORT (0xFFFFFF01) NO_ADVERTISE (0xFFFFFF02) NO_EXPORT_SUBCONFED (0xFFFFFF03) NOPEER (0xFFFFFF04)   Thank you for the responses,   ... View more

Hi,   Thank you for your time.   That doesn't solve our problem. There is no way to set "well-known" communities on your link, just standard communities like xxx:yyy.   So, maybe isn't posible to do that?   Thank you ,     ... View more

Hi Gwesson, Thank you for your words, I understand how It works, thank you for your explanation. But the fact is that the test that I am doing is the way of working that our customer has. Workers in remote sites download files via HTTP and via FTP through Global Protect and L2L VPN and it is difficult to download the same file in múltiple parts as you are suggesting. I am just surprised by the degradation of speed in a device with these characteristics, when the current equipment, much more older (ASA FW) and through VPN supports speeds by far much better doing the same. Appreciate for your help, Thank you, ... View more

Hi, Thank you for your response. Im try to explain better the scenario. 1st Test. One computer behind the firewall (Site A) downloading a file from https://www.thinkbroadband.com/download I achieve acceptable speed. Im the only one using the firewall, no security profiles attached to the rule. 2n Test. From a computer in a remote site (Site B) and download the same file, I achieve better results due to the best line in Site B. 3rd Test From Site B establish a GP IPsec to Site A without Split tunneling, so all traffic crosses the FW. I go to the same Site and download the same file, the download speed dramatically slowdown. In 2nd and 3rd scenario I'm the only one crossing the FW. Regards, ... View more

Hi, Thank you for your response. Im try to explain better the scenario. 1st Test. One computer behind the firewall (Site A) downloading a file from https://www.thinkbroadband.com/download I achieve acceptable speed. Im the only one using the firewall, no security profiles attached to the rule. 2n Test. From a computer in a remote site (Site B) and download the same file, I achieve better results due to the best line in Site B. 3rd Test From Site B establish a GP IPsec ti Site A without Split tunneling, so all traffic crosses the FW. I go to the same Site and download the same file, the download speed dramatically slowdown. In 2nd and 3rd scenario I'm the only crossing the FW. Regards, ... View more

Hi, Thank you for you reply. This device is in test environment prior to full migration. So unfortunatelly yes, no other traffic is crossing the firewall. I don't trust on those speedtest, the test im doing it's director download vía browser from some website that offers Free test downloads. Where you tune the tunnel capacity? Regards, ... View more

Let's if someone can add more light to this subject. I know about the overhead, for this reason I check-in MTU or MSS but the performance it's not acceptable. Datasheet says 500mbps... The are a lot of difference between 62MBs expected vs 5-6MBs... Thank you, ... View more

The PA850 sheet talks about 500Mbps (62MB/s) IPSec throughput. There are NO profiles attached to the rule, the throughput following the datasheet without profiles are about 2Gbps... If you hace 100mbps as you said this is 12MB/s so if you are receiving 10MBs this is acceptable. So, i don't understand where the bottleneck happens. It's nothing related about price fot security.. it's just specs. Thank you, ... View more

Hi, finally the rules are separated and works correctly. We will remain in this configuration because is working, but I think a problem exists mixing static and dynamic url.   Thanks to all for your help, ... View more

HI,   Any suggestion in this case?   After separate the rules (one with EDL and other with static group) seems that all is working fine, so it's something related about how PAN treat EDL and Static Groups in the same rule. Any new suggestion on that?   Regards! ... View more

Hi,   Why you don't create a rule from Outside to Outside with VIP as destination and DNAT of your internal IP? It must work.   How about you security rule? It is create Outside to Internal with VIP ip on destination field?   Regards, ... View more

Hi Kiwi,   Thank you for your response but not seems to clarify this behaviour.   Why action allow if rule says block? There's nothing to evaluate, just if you are trying to go to any address inside the EDL or static addres group just deny.   I understand what you say about identify application, but in this case it's just IP to IP decision.   Thank you! ... View more