About Jedi_D

Jedi_D · ‎02-19-2020

Hi thanks, That's good to know.... I'm just confused on one of the steps.... Is there any more info how to do the following.... sorry for being a noddie, but I havent done this before and just wanted to get a handle of it... Now generate on a client certificate on both firewalls and sign each one with the imported CA certificate.

Jedi_D · ‎02-18-2020

Hello folks, This might be a newbie type of question so I appreciate your patience..... I need to create a site to site VPN using a self signed certificate. I'm happy to do the site to site VPN. But ........... I'm not sure how to use self signed certs for doing this. Does anyone have any procedure of how to do this using certificates? Are there any links that would help me get started? I've only found this for pan-os 6 but I'm using pan-os 8 https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClJdCAK Do I need to create a Self-Signed Root CA Certificate first ?? before I generate a certificate? Any help appreciated! Thank you. Rgds Dinesh

Jedi_D · ‎01-24-2020

Thank you people, I think I will stick to A/P I'm going to do BGP as well, and even that can work fine with A/P instead of having 2 separate BGP peers with A/A and BGP metrics. i'm just wondering why people would have chose A/A then have issues with apps later on...

Jedi_D · ‎01-22-2020

Hello Folks, I'm planning on getting two new Palo Alto firewalls for setting up IPSec tunnels. I think the first tunnel will be a primary tunnel and the second tunnel will be back up. I'm tempted to set up my new firewalls as active/passive HA, to make life easy. But to be sure, please could someone suggest what are the advantages of using active/passive compared to active/active for dual IPSec tunnels? I'm going to be using BGP over the IPSec tunnels and BGP to the LAN, so if I go for the active/passive option, it just means i dont have to double up my BGP peers... Any links to the best practices for BGP and IPSec HA would be appreciated... thanks

Jedi_D · ‎04-27-2019

Hello Folks, I have a simple BGP question. I'm going to be creating a BGP peer between a Palo Alto firewall and a Cisco router. Do I need to create a security policy allowing TCP/179 between my Palo Alto firewall and the router. They are directly connected. I cant find any examples of that.... so hopeing some can advise. thank you.

Jedi_D · ‎04-27-2019

Thanks, I simply created a new DMZ for the leased line

Jedi_D · ‎04-09-2019

It's for a service that is available over leased line well as the internet. I want to use the leased line for these services instead of using the default NAT statement for the internet.

Jedi_D · ‎04-09-2019

Hello Folks, I need some advice .... I want to create a NAT rule to allow traffic to NOT be NATTED if it is going to a particular website. e.g. if going to www.paloaltonetworks.com then dont NAT. Is it possible to use URL objects for in a NAT policy?? Please could someone suggest how this can be done, or send me some useful links for doing this? Thanks

Jedi_D · ‎05-23-2018

thank you people, I appreciate all the answers. But I can only accept one solution.... thank to you all.

Jedi_D · ‎05-22-2018

Hello folks, I want to use a wildcard for a FQDN, e.g. *.paloaltonetworks.com I want to use this as an object with a FQDN for the destination. I read in the following article I need to create a custom URL category, and use that in the "service/URL category" as part of the security policy. I was hoping to use this as a destination IP address but it looks like you cant do that, as you need to specify the FQDN as a URL catergory. My question is, what do I use for the destination IP address in the securty policy??? I am guessing it would be any IP adresses, and the limiting factor will be the URL category. https://live.paloaltonetworks.com/t5/Featured-Articles/DotW-FQDN-Policy/ta-p/65110 Any help appreciated.... we live in a complicated world! thanks D

Jedi_D · ‎05-09-2018

Hi people, I want to troubleshoot a connectvity issue.... typical problem where server guy says "it's a firewall issue". Can anyone suggest what's the best way to allow all traffic? I was thinking of traffic from my source (10.0.0.0/8) to destination B10.1.0.0/8) but use Application: ANY Service: ANY log both start and stop turn off virus checking, turn off anti spoofing. I want to avoid any issues with application ports and service types. Is service any, application any the best way to make the policy to allow all traffic? Or should i consider specifying application unknown-tcp and unknown-udp with service any or application default? Any suggestions would help. thank you. D

Jedi_D · ‎04-24-2018

Thanks, that's given me an idea... how about doing the changes on the GUI, then doing a commit-> compare this will show the new config to be added. If I can get this new config in set format, then I could just copy it into the FW at a later date. problem is: how to get the new config in the "set" format.

Jedi_D · ‎04-24-2018

That is very interesting, so thak you very much. I will try this out on a lab: 1) make changes to the candicate config 2) save "save named configuration snapshot" 3) revert the changes 4) then "load named configuration snapshot" 5) commit. But if someone makes changes between the time me "saving the named config snapshot" and "loading named configuration snapshot", then their changes will be lost... thats my logic... if that is the case, then maybe I cant use this technique....

Jedi_D · ‎04-23-2018

Hello friends, I have a question about saving my firewall changes and then applying them at a later date. What I want to do, is enter all my changes into a production firewall, but then not commit them. I want to save just my changes, ie a small configlet. And then at a later date, "load" my changes and commit them (during out of production hours). I know this can be done, but not sure what the best methods is. Should I use "load" configurations or "revert" configs. I dont want to commit my changes into production by accident........... so any advice would be appreciated on the best method. Thanks.

Jedi_D · ‎01-13-2018

Thank you for your help and response Bpry, Is this application already available or should I define one? Also please could you suggest what the service should be? Could it be "service-default"? Thanks and regards,

Jedi_D · ‎01-12-2018

Dear Friends, I'd be grateful if you could help me with this ... I'd like to allow GRE traffic (protocol 47) through my Palo Alto FW. I want to allow all the GRE traffic through and not terminate a GRE tunnel on the PA itself. Appologies if this is simple, please can someone point out how I can do this? Do I need to create a FW policy to allow GRE protocol 47? Any suggestions or any documents references would be much appreicated. DP

Date Registered	‎12-09-2016 08:48 AM
Date Last Visited	‎03-06-2020 05:21 AM
Total Messages Posted	17

Online Status	Offline
Date Last Visited	‎03-06-2020 05:21 AM

About Jedi_D

Re: How to configure a site to site VPN with Self signed certificate

How to configure a site to site VPN with Self signed certificate

Re: IPSec tunnels - Active/Passive OR Active/Active

IPSec tunnels - Active/Passive OR Active/Active

BGP - TCP/179

Re: NAT - with URL for NAT policy

Re: NAT - with URL for NAT policy

NAT - with URL for NAT policy

Re: wildcard fqdn for destination in security policy, custom URL category

wildcard fqdn for destination in security policy, custom URL category

Best way to allow ALL traffic for troubleshooting

Re: Best way to save new config, so they can be loaded and committed later?

Re: Best way to save new config, so they can be loaded and committed later?

Best way to save new config, so they can be loaded and committed later?

Re: How to allow GRE protocol 47 through Palo Alto FW?

How to allow GRE protocol 47 through Palo Alto FW?

Re: How to configure a site to site VPN with Self signed certificate

How to configure a site to site VPN with Self signed certificate

Re: IPSec tunnels - Active/Passive OR Active/Active

IPSec tunnels - Active/Passive OR Active/Active

BGP - TCP/179

Strata

Prisma

Cortex

About Jedi_D