About jac101

I would like to add a virtual F5 as a proxy to our exsiting 5220 PA FW. As I have never done a DMZ to a virtual device, I am jsut wondering there a sample scenario or configuration.  If my F5 was a physical device, I will just assign an IP address to my FW interface with zone as DMZ. But if my DMZ device is virtual (setup in the datacenter in the inside network), how would I configure my FW interface?    I found this picture from a thread in this community and that is what I'd like to setup, except that the DMZ is virtual. Thank you in advance for any thoughts.   ... View more

My Palo Alto PA200 e1/1 (10.10.10.1/30) is connected to router A and e1/2 (10.10.20.2/30) is connected to router B. The server 192.168.1.100/24 is behind router A (10.10.10.2) which has a static router to destination 172.16.1.0/24 with next hop 10.10.10.1. The user 172.16.1.100/24 is behind router B (10.10.20.1) which has a static router to destination 192.168.1.0/24 with next hop 10.10.20.2.   On my PA, I have static routes and policy below: - destination 172.16.1.0/24 next hop 10.10.20.1 (Router B) via interface e1/2 - destination 192.168.1.0/24 next hop 10.10.10.2 (Router A) via interface e1/1 - policy allow source-address ZONE-ROUTER-A source-address 172.16.1.0/24  destination-zone ZONE-ROUTER-B destination-address 192.168.1.100 with any apps and services,      It looks like I have a routing between the 2 subnets from my PA FW. My FW can ping 192.168.1.100 sourcing 10.10.10.1 and 172.16.1.100 sourcing 10.10.20.2. But I cannot ping  192.168.1.100 sourcing 10.10.20.2 and 172.16.1.100 sourcing 10.10.10.1. The strange thing is I can see the pings going through from the MONITOR on my PA200 when 172.16.1.100 tries to ping 192.168.1.100. But the ping from the user says failed.   Any inputs will be greatly appreciated. Thx   Am I missing a policy?  ... View more

I am using this link https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-High-Availability-on-PAN-OS/ta-p/54086 to try to configure active/standby HA on my 5020 and I am confused about the ports (control links (CL) ha1, CL ha1 backup, data link (DL) ha2, and DL ha2 backup) and the assigned IP addresses. Why do I need to use management for CL ha1? Do I need to assign an IP address for DL ha2? I am trying to search for a tutorial for the HA on the 5020 but could not find it. Any feedback will be greatly appreciated. Thanks I configured as below but I am not sure about the management CL ha1. My management has 192.168.1.1/24.   pic ... View more

My PA already has a Default Gwy pointed to the current Internet provider. I got a new Internet provider and I'd like to test the Internet connection by only allow my traffic to go to the new Internet connection. What is the side effect if I add another Default Gwy pointed to the new Internet provider? Thx ... View more

I configured IPSec VPN tunnel between my  2 PA FWs. The physical interfaces are up but the tunnel is not up. I am a Cisco guy and new to the PA. I am trying to see ipvpn traffic va the Monitor. But I did not see any traffic. How do I check for my ike phase 1 and ipsec phase 2 to make sure that all the parameters and the password matched on both side. Also, how do I need which side is the initiator and which side is the receiver? Thanks ... View more

I am trying to understand how to advertise my network 10.10.10.0/24 via BGP with the Palo. in the Cisco world, I use the command NETWORK 10.10.10.0. But with the Palo Alto, is it EXPORT or REDISTRIBUTION? Any comments will be greatly appreciated. Thx ... View more

I have a VPN configuration and testing with my vendor during business production hours. I am new to PA, so I am just wondering if I should schedule this during a maintenance window. The VPN implementation includes: - tunnels - IP addresses - static routes - BGP routes   Thanks ... View more