About Jedi_D

Jedi_D · ‎02-20-2021

Hello, I'm doing an active/passive set up with BGP. I will have a router to a the active FW. I will have different router to the passive FW. The second FW will only have BGP peers up when the active FW fails. I am going to have VLANS for the HA 1 and HA2 links. Do I need to have the data planes (data port dmz interfaces) spanned across the FWs are well? For example, FW A interface 1 is 10.0.0.1/24 in Vlan A FW B interface 1 is 10.0.0.1/24 in Vlan A Does VLAN A need to be connected between the FWs?

Jedi_D · ‎02-01-2021

Thanks Reaper, I think I'm going to create a management vsys to connect to the AD server. Then create an auth profile for AD using the management vsys. I believe this Auth profile can then be used by all my individual vsys. So should be ok.

Jedi_D · ‎01-21-2021

Hello people, I have a novice question so apologies if it is too obvious to some. I have created 5 vsys and I want to use the same Active Directory server in all 5 vsys (vsys A, B, C, D,E) for userid in policies. The Active Directory is only routable via one of the vsys (vsys A). Does this mean that I should create an interface in the other 4 vsys so I can reach the AD server from each vsys? so vsys B would have an interface to a router which can reach the AD server. so vsys C,D and E would have an interface each to a router which can reach the AD server. Or is there a way to share the AD between vsys? I'm a novice to AD so any help appreciated.

Jedi_D · ‎01-04-2021

Thank you Tom, that is good to hear. I will span each HA1A, HA1B and HA2, on different vlans - then trunk them together and use layer 2 pseudowire to span them across sites. And I can adjust the timers if it doesn't work. I'm a happy man!

Jedi_D · ‎01-02-2021

Hello, I'm still learning PA and I'm planning to create a pair in HA Active/Passive mode. I was planning on connecting HA1A, HA1B and HA2 to a Cisco switch. Each port on a different VLAN. I was then going to trunk this traffic to a Cisco router (ASR920). I'm then planning to link two sites using layer 2 MPLS pseudowire. As anyone experienced any issues using Layer 2 MPLS pseduowire to span the HA ports using vlans? It's a long shot, but if anyone has tried this then any experiences shared would be appreciated. Thank you D

Jedi_D · ‎05-21-2020

Hello Folks, We found out why the PBF was not working.... I think it is a bug, we had to take out the next hop IP address from the PBF statement. We left the interface for the next hop only. This allowed the PBF to work. I don't know why using an IP address for the next hop doesn't work. I suspect it is because we have a pair of active-active firewalls. We also we tried all the different binding options in the PBF statement on both firewalls.

Jedi_D · ‎05-12-2020

hi For the next hop on the policy based forwarding (PBF) , I gave both the interface it should leave, and the next hop IP address on that subnet. I still cant understand why for some traffic it is not hitting the PBF I can see that for one host in the PBF source range, it is getting corrected policy based forwarded. Both for another host also in the PBR range, it is being natted first, and therefore not policy based forwarded.

Jedi_D · ‎05-12-2020

Thanks for replying Reaper L7 Applicator ... nice name. The application is any. The service is any, I'm wondering if I should set them to application-default. I've noticed that where it's not working, (not getting Policy based forwarding), it is getting NATTED first.

Jedi_D · ‎05-11-2020

Hello Folks, I'm trying to set up my Palo Alto to do Policy Based Forwarding. Does PA do NAT before Policy Based Forwarding??? I've created Policy based forwarding to send traffic to an interface, if it is sourced from an address. 10.0.0.0/24 BUT it's seems to be failing ... sometimes. I've noticed that it fails when the source traffic is NATTED first. So there is a NAT that changes the source address from 10.0.0.0/24 to 20.0.0.0/24 The PA doesn't do the Policy Based Forwarding, because it doesn't see the traffic come from 10.0.0.0/24 as it is natted. Does that mean that the NAT is done before the Policy Based Forwarding? I guess it is? If I only want traffic to be policy forwarded if sourced from 10.1.0.0/16. So would my work around be to create a NAT policy, and if it matches 10.1.0.0/16 then do not NAT? That way it will then keep the source address and be policy forwarded instead? Any thoughts would be appreciated?

Jedi_D · ‎02-19-2020

Hi thanks, That's good to know.... I'm just confused on one of the steps.... Is there any more info how to do the following.... sorry for being a noddie, but I havent done this before and just wanted to get a handle of it... Now generate on a client certificate on both firewalls and sign each one with the imported CA certificate.

Jedi_D · ‎02-18-2020

Hello folks, This might be a newbie type of question so I appreciate your patience..... I need to create a site to site VPN using a self signed certificate. I'm happy to do the site to site VPN. But ........... I'm not sure how to use self signed certs for doing this. Does anyone have any procedure of how to do this using certificates? Are there any links that would help me get started? I've only found this for pan-os 6 but I'm using pan-os 8 https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClJdCAK Do I need to create a Self-Signed Root CA Certificate first ?? before I generate a certificate? Any help appreciated! Thank you. Rgds Dinesh

Jedi_D · ‎01-24-2020

Thank you people, I think I will stick to A/P I'm going to do BGP as well, and even that can work fine with A/P instead of having 2 separate BGP peers with A/A and BGP metrics. i'm just wondering why people would have chose A/A then have issues with apps later on...

Jedi_D · ‎01-22-2020

Hello Folks, I'm planning on getting two new Palo Alto firewalls for setting up IPSec tunnels. I think the first tunnel will be a primary tunnel and the second tunnel will be back up. I'm tempted to set up my new firewalls as active/passive HA, to make life easy. But to be sure, please could someone suggest what are the advantages of using active/passive compared to active/active for dual IPSec tunnels? I'm going to be using BGP over the IPSec tunnels and BGP to the LAN, so if I go for the active/passive option, it just means i dont have to double up my BGP peers... Any links to the best practices for BGP and IPSec HA would be appreciated... thanks

Jedi_D · ‎04-27-2019

Hello Folks, I have a simple BGP question. I'm going to be creating a BGP peer between a Palo Alto firewall and a Cisco router. Do I need to create a security policy allowing TCP/179 between my Palo Alto firewall and the router. They are directly connected. I cant find any examples of that.... so hopeing some can advise. thank you.

Jedi_D · ‎04-27-2019

Thanks, I simply created a new DMZ for the leased line

Date Registered	‎12-09-2016 08:48 AM
Date Last Visited	‎02-24-2021 06:41 AM
Total Messages Posted	26
Total Likes Received	1

Online Status	Offline
Date Last Visited	‎02-24-2021 06:41 AM

About Jedi_D

active/passive BGP - Data plane VLANS

Re: UserID Active Directory multiple VSYS

UserID Active Directory multiple VSYS

Re: Layer 2 MPLS pseudowire to span HA ports across sites.

Layer 2 MPLS pseudowire to span HA ports across sites.

Re: Layer 2 MPLS pseudowire to span HA ports across sites.

active/passive BGP - Data plane VLANS

Re: UserID Active Directory multiple VSYS

UserID Active Directory multiple VSYS

Re: Layer 2 MPLS pseudowire to span HA ports across sites.

Layer 2 MPLS pseudowire to span HA ports across sites.

Re: Does Palo Alto do NAT before doing Policy Based Forwarding

Re: Does Palo Alto do NAT before doing Policy Based Forwarding

Re: Does Palo Alto do NAT before doing Policy Based Forwarding

Does Palo Alto do NAT before doing Policy Based Forwarding

Re: How to configure a site to site VPN with Self signed certificate

How to configure a site to site VPN with Self signed certificate

Re: IPSec tunnels - Active/Passive OR Active/Active

IPSec tunnels - Active/Passive OR Active/Active

BGP - TCP/179

Re: NAT - with URL for NAT policy

Network Security

Cloud Security

Security Operations

About Jedi_D