About cengasser

cengasser · ‎04-24-2020

Couple of questions on FIPS. When you enable FIPS140 on a Palo it wipes the device. Can you just reload your last saved? Can a FIPS140 enabled device talk to a non-FIPS device over an ipsec tunnel provided the cyphers are compatible? FIPS disables PAP. System wide? or Just for authentication to the FW? Our Radius doesn't support CHAP. Anything else that will cause my resume to spontaneously print out? Thanks.

cengasser · ‎07-09-2018

I've run into a couple of situations where I've had to update the firewall configuration manually because it was disconnected from pan (The ISP forced me to change IPs). The config in Panorama remains unchanged. How do I update this without deleting and re-adding the device? Can I just do another import device config like I'm doing it for the first time?

cengasser · ‎06-13-2018

Hi there. I have a site with a 3020 (the only reason this site has a 3020 is when the device was bought, everyone thought it would be doing more than it is). They are in a region that doesn't have 4-hour support, so they wanted a spare. The only thing the 3020 is doing is running a IPSEC tunnel to corp, and handing SIP traffic from 2 internal hosts to two external, but local hosts. Port 1 is configured untrust, and port 2 is configured trust, and that's pretty much it except for management configurations. Max bandwidth on the internet is 20Mbit. Seemed silly to buy another 3020, so we bought a 220 to be the spare. My question is.... Can I just export the config out of Panorama for the 3020, and import it into the 220 without issue? I've done this for like-2-like devices, but the 3020 has more ports on it. If I recall the configuration doesn't show unconfigured ports, but I don't know what happens after the configuration is committed. Thanks.

cengasser · ‎02-28-2018

trying to find out if there's a list of the various messages and what they mean, particulary with 'globalprotectgateway-logout-succ'. I'm specifically trying to identify what 'Reason: remove previous login' means. I assume it means the previous session didn't close and a new session was created, like if the user's machine goes to sleep or reboots. Can't find any sort of rosetta stone for this in Palos' documentation. Thanks.

cengasser · ‎11-29-2017

I have a HA-pair of 3050s in my corp office with an single existing IPSEC tunnel to a remote office on a 200. The remote office has very poor reliability on it's existing connection and the local ISP has provided them with a backup satcom link they can use when the prime connection goes down. the HA-pair sits behind a Single IP that's managed via BGP on a HA-pair of routers with redundent internet links. The main IP will float between the routers using HSRP. If it was only a matter of flipping a route on the remote 200, it wouldn't be an issue, but how do I get the tunnel to migrate from one local IP to another? Thanks.

Member Since	‎11-03-2016 05:23 AM
Date Last Visited	‎01-31-2021 09:31 AM
Posts	16
Total Likes Received	1

Online Status	Offline
Date Last Visited	‎01-31-2021 09:31 AM

About cengasser

FIPS 140 and CC enabling

Updating Panorama device templates after forced changes

Installing config on a different model.

GP user logouts.

Question about redundent paths with IPSEC Tunnels.

Feature Request

Re: GP user logouts.

FIPS 140 and CC enabling

Updating Panorama device templates after forced changes

Installing config on a different model.

GP user logouts.

Question about redundent paths with IPSEC Tunnels.