About MatthewSabin

We put it in lab last week - no issues to report. We'll start testing in the production environment after the holidays. ... View more

I'll revive this question - as the answers didn't actually relate.   The Cisco ASA packet tracer allows you to propose a hypothetical flow and runs it through the engine as if it were real. Evaluating the NAT and route dicisions which would likely apply in addition to the policy/ACL allow/deny logic.   It was very helpful to see if your configured configuration should pass traffic you are planning for prior to the actual traffic arriving. ... View more

Thankyou chris.russell for this one, we've been pulling our hair out trying to build an XML file "template" This will make our configuration push script much easier to build. ... View more

I'm about 2-months in, and I'm still looking for what I need to know.   What I most want is the "How to think Palo Alto" guide - the biggest picture of how the parts fit together, and the minute details of what little "other-guy" process or method doesn't work here.   I'll publish it myself once I think I have it 😉 ... View more

i'll eat my crow now...   Problem solved: Bad cable/ethernet jack on upstream router. All successful connections correlate with events where a coworker was forcing the lab traffic over a different link. His timing just made my troubleshooting harder.   Layer 1 sure gets in the way when you're think 4 through 7. ... View more

I got my SE on the case and while studying packet-captures it suddenly seemed like the communication was great until the packets got big. We wondered if it could be an MTU problem.   I put a laptop in the PA220's place and ran through the connections at MTU 1500 - AOK. Put the laptop in the client's place and had to drop down to 1400 to get the transfers to go.   We couldn't find anywhere in the PA220 where MTU was set below default (1500?) but when we turned on jumbo-frames and set the GlobalMTU at jumbo-default, and rebooted, all flows pass properly.   Yay, but really?! ... View more

Is there a better way than a screen shot?   Here's the ruleset I have, only NetAdmin and NTP work at this time. ... View more

Sorry, I confused the thread there.   There are three processes which my IoT device preforms: NTP, FTP, HTTPS NTP: get the time (obviously I suppose) - this works perfectly, UDP out, UDP in session times out, repeat FTP: check for updates, download and install them automagically - the check works, the GET to pull down update fails HTTPS: send telemetry to the cloud (the function we've installed the thingh to perform) - the client hello and key negotiation work fine, firewall stops passing as soon as encryption is engaged. ... View more

It's not a decision I get to make - IoT means "I'll make this thing and decide how it woll communicate and you can take it or leave it" for the most part - sigh.   My laptop in the thing's spot can connect on the TCP/21 port and I can authenticate etc. It's only when I try to GET a file that the connection times out. Once the server stops trying to send and the client stops trying to GET, I have CLI back and can try GET again.   I've got the same behavior in the web browser. The client session starts helloing and negotiating then when TLS is engaged, I stop getting packets.   Is there a knob or switch set someplace which tells the PA to analyze the streams and I've got it set at 10 when it needs to be turned down to 2? ... View more

I hope OP will forgive me for hijacking this thread.   I too have a client behind the firewall trying to connect to an FTP site. The session end is always noted as tcp-rst-from-client. It's an IoT-thing, so I did a packet capture and see the device connect, log-in (plaintext password - ick!) and navigate to the desired directory, change to binary, attempt to get a file, after that fails, set passive and try to get the file again.   My capture shows the client request the get, and the server attempt to send, but the client never gets the packet.   I put my laptop in the client's spot and tried from my FTP client - same resuts. Each get times out.    apparently the PA220 is eating the reply packet, yet I can't find loggin to that effect.   Where do I look next? ... View more