About rmfalconer

rmfalconer

SSL decryption is used to better observe the traffic going through the firewall. It's not enabled by default. You can tell if it's in use by looking at a certificate of a site and seeing that it's secured by the forward proxy cert defined on the firewall. The forward cert must be issued by an authority that all the endpoints trust or you'll get warnings. There are articles in the KB about it, how to configure, the traffic flow, what to exempt from decryption. Have you looked through those?

rmfalconer

You can use BGP in this scenario. You can request just the default route from each ISP and then set the LP higher on the circuit with more bandwidth. If you want to do some load sharing, many ISPs will offer their provider routes. If you take this option from the ISP with lower bandwidth, it would allow you to send traffic destined to sites that are in that ISP's network out that circuit. You'd still want to set the LP of the default higher on the circuit with more bandwidth. If you do this, make sure to set up any necessary filters so you don't become a transit network between the ISPs.

rmfalconer · ‎02-11-2020

Do you have any import and/or export filters for BGP? Using filters is a pretty standard way to control prefix advertisement and learning.

rmfalconer · ‎02-11-2020

Can you explain what you mean by different distance for each route? Do you mean administrative distance?

rmfalconer · ‎01-27-2020

Can you provide an example of what you're trying to do?

rmfalconer · ‎11-20-2019

> show interface management This provides the mac address.

rmfalconer · ‎11-19-2019

If you use a separate VR, then you'll need another interface in that new VR connected to your L3 switch for access to the networks it manages. The L3 switch will also need a static route for the GP client network pointing to the new VR internal interface.

rmfalconer · ‎11-18-2019

When they say client, do they mean the workstation trying to get the IP address? That machine shouldn't receive a discover since it's the one broadcasting. The discover goes to the server, which responds with an offer. Is the offer being received by the client?

rmfalconer · ‎11-14-2019

Access to the machine cert store is not available to standard user accounts. It requires elevated permissions. Not sure if GP can get around this if a user is already logged in to the machine. @MickBall , do your users have admin rights on the workstation?

rmfalconer · ‎11-14-2019

I'm not familiar with what GoDaddy provides exactly but I would expect they have a cert repository publicly available where you can download anything you need. Also, after creating the cert, there is probably a way to download a single file that contains root, intermediate and entity certs. There should be plenty of documentation on importing the certificate chain to the PA. For the difference in root and intermediate, you can read about certificate chains and that should explain it.

rmfalconer · ‎11-13-2019

If it's self-signed by the PA, you would have to distribute the root cert from the PA to all of the phones. The problem is the phones don't trust the identity cert presented because they don't trust the CA that issued it. Are the phones typical mobile phones? If you purchase a cert from a trusted authority, you shouldn't need to worry about distributing any root or intermediate certs to the phones. They should already have those in their trusted authority store. Public CAs do have root and intermediate certs available for download so you can install them on devices/appliances that don't have built-in stores.

rmfalconer · ‎11-12-2019

Another option would be to create a separate virtual router for the other ISP connection and keep the GP traffic on that. That way you can manage routing separately and not worry about PBF.

rmfalconer · ‎11-12-2019

Another difference in the ASA vs PA is the security levels applied to interfaces. The PA doesn't have the concept of permitting higher to lower unless specifically denied. Everything is denied unless specifically allowed. As @SteveCantwell said, if interfaces are in different zones, traffic is not permitted between them unless a policy is in place.

rmfalconer · ‎11-11-2019

Where are you using the self-signed cert? For what function? Popular public CAs are Comodo, Digicert and Godaddy. Any of these should already be included as a trusted root cert authority on your endpoints.

rmfalconer · ‎11-11-2019

We run multiple vsys with a separate vr for each vsys. Each interface is assigned to a specific vr. We use a single ISP subnet and multiple vsys do use the same gateway. When you look at arp information in the CLI, you can look at 'sh arp all' or 'sh arp <interface>'. 'sh arp <interface>' is like 'sh arp vrf <vrf>' and it will only show entries specific to that interface. 'sh arp all' is like the Nexus command 'sh ip arp vrf all' and will display all entries. If you look at either, you'll see the same entry for the gateway present on different interfaces. So there are different entries per vsys. show arp ethernet1/1 | match .19 ethernet1/1 x.x.x.19 2c::::6f:00 ethernet1/1 show arp ethernet1/5 | match .19 ethernet1/5 x.x.x.19 2c::::6f:00 ethernet1/5 show arp all | match .19 ethernet1/1 x.x.x.19 2c::::6f:00 ethernet1/1 ethernet1/5 x.x.x.19 2c::::6f:00 ethernet1/5

rmfalconer · ‎10-30-2019

Did you check the CLI output?

rmfalconer · ‎10-29-2019

Yes, that's the basis of it. The addresses and variables in that link won't be correct for your implementation. The AWS portal will provide the configuration specific to your environment.

rmfalconer · ‎10-29-2019

Couple of things to mention. Is that EDL 'Unassigned IPv4' actually referenced in a policy? If not, it won't show any entries. If it is referenced, did you check the CLI? you can view entries with: request system external-list show type ip name "Unassigned IPv4" We do use many of the lists at https://panwdbl.appspot.com/ with no issues. We also keep a custom list that we manage on a local web server.

rmfalconer · ‎10-29-2019

Is there a specific reason you need to use PBF? AWS provides a detailed template on using BGP with VPN connections to PAs.

rmfalconer · ‎10-21-2019

When creating SAN entries, you always put the common name as a SAN entry as well. If you add the IP address as a SAN entry, make sure the type is IP Address (v4) instead of DNS name. When I create certificates for devices like a PA, I do as shown below. The cert will be valid if you access with FQDN, short name or IP. Common Name = devicename.domain.com SAN: DNS= devicename.domain.com DNS= devicename IP Address (v4) = IP Address

rmfalconer · ‎10-16-2019

PA firewalls use the 802.1ax standard so all interfaces in an etherchannel are active. LACP isn't required for aggregate interfaces but it does provide some features that are helpful in certain situations. The PA doc says the traffic is load-balanced, which isn't really accurate. It's more of a load-share depending on settings.

rmfalconer · ‎10-04-2019

Maybe try a match instead of a filter? That might get you the info also. show system state | match phy

rmfalconer · ‎10-02-2019

I just want to make sure I'm thinking through the use of SIP inspection. If I have the sip application configured on a security rule, then the ALG will be in affect. If I have defined port-based services in a security rule with no sip application defined, then the ALG will not be in affect. SIP inspection will only happen if the application is defined in a policy.

rmfalconer · ‎03-26-2019

If this is going over the internet, it won't be possible. RFC 1918 address space doesn't get routed over the internet. Whatever sits in front of the other peer needs to do NAT for it to work.

rmfalconer · ‎03-18-2019

Where did you set IGP before?

rmfalconer · ‎03-16-2019

Did you set the origin to IGP on the matching BGP export rule? One thing I'll mention is that I had problems with BGP configurations in earlier PANOS versions. The GUI wouldn't match with the CLI output. You could make sure the necessary config is present in the CLI. But I think that was fixed in 7.1 so it shouldn't be a problem on 8.1.

rmfalconer · ‎03-13-2019

Static and connected are two different sources so you wouldn't want to use them interchangeably. Connected would be a network that is directly defined on the firewall. Ex: Loop0 has an IP address of 10.1.1.1/24. The connected route for that is 10.1.1.0/24. Static route redist is to get static routes defined on the firewall into BGP.

rmfalconer · ‎03-13-2019

Is there any way you can make the OSPF routes more specific than the BGP routes? Do some summarization with BGP when you export the prefixes to a peer? If the routes are the same, then administrative distance is used to determine which to use and will take the lower value. You can change the administrative distance of the routing protocols but that would affect the entire virtual router.

rmfalconer · ‎03-04-2019

So both old and new firewall are set to True? I think you said you're using the copper interfaces on the PA? Do they connect directly to the A10? SFPs on another device shouldn't matter for the connection to the PA.

rmfalconer · ‎03-04-2019

The setting that shows that asymmetry is permitted is "TCP - reject non-SYN first packet: False" Is this on both firewalls? Are you absolutely sure that this is a setting you want enabled? It's definitely not best practice to enable. Do you know why you have flows bypassing the firewall?

Date Registered	‎02-06-2017 10:18 AM
Date Last Visited	yesterday
Total Messages Posted	144
Total Likes Received	25

Online Status	Offline
Date Last Visited	yesterday

Strata

Prisma

Cortex

About rmfalconer