About bjdraw

I'm sure I'm not the first one to do this, but since I wasn't able to find a document on how exactly to do it, I figured I'd contribute one. I'd appreciate any corrections or optimizations. The Azure side documentation is pretty clear online and honestly there aren't many options available to configure. But here are is my Azure address space for clarification. And my defined local networks, with a gateway address of my PAN VPN endpoint. Next I configured the Tunnel interface, which is pretty vanilla , just have to assign an IP on the same subnet as the Azure Gateway Subnet (I used the last usable IP on the subnet), select a virtual router and the appropriate security zone (the zone I selected is the same as the one my other servers are on, so I don't need new policies). The settings of my default IKE Crypto profile were the same as for Azure, but here they are just in case. I had to create a new IPSec Crypto Profile for Azure due to the 3600 lifetime instead of lifetime on my other tunnels (you can modify the default if this is your only tunnel or if your other tunnels use the same settings). Create an IKE Gateway selecting the external interface of your PAN and the IP of that interface for "Local IP Address" (this will match the VPN Gateway Address configured on the Local Address in Azure that you're tunneling to). The Peer IP Address can be obtained from the Azure Virtual Network Dashboard of the same Azure Virtual Network. The Local Identification IP Address should match the Local IP Address on the same screen. The Pre-shared Key can be obtained by clicking "Manage Key" on the Azure Virtual network Dashboard of the Azure Network, then copy and paste it Now create a new IPSec Tunnel with the newly created Tunnel Interface, IKE Gateway and IPsec Crypto Profile. Go to the Proxy IDs tab and create at least one ID with the appropriate local and remote subnets (Local should matched the defined "Local Networks" you configured in Azure with the appropriate gateway address of your PAN IPSec tunnel endpoint and remote should match the configured Azure address space). Finally create a route to direct traffic via the tunnel interface to the Auzre Virtual Network. At this point a ping to the Azure Virtual Network should bring the tunnel up, if not, check the System log to troubleshoot (at this time no ping responses are received, but other traffic is working, need to figure that one out). ... View more

Sorry if this is inappropriate here, but I figure who else better to ask than other Palo Alto Networks customers. As much as I love our PANs, unlike some other firewalls, they don't really help with spam. So I'm wondering if other users would mind sharing their success stories. Our current solution is GFI Vipre Email Security on the Exchange 2010 server and we're up for renewal and would prefer to move in the direction of an appliance or other off Exchange solution. ... View more

Just upgraded from NetConnect to GlobalProtect when we upgraded to 4.1.2 and on OSX I don't see a way to remove the GlobalProtect icon from the OSX menu bar. I understand if it needs to be there when using GlobalProtect, but I only use it ocasionaly and would prefer not to have it displayed all the time. ... View more

We're running 4.0.5 and Facetime does not work as the packets coming from Apple's servers via the Internet are dropped. I noticed there was an ALG for H.323 in 4.1 but wasn't sure if that was related to Facetime or if there was anothe work around. ... View more