This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About StephenBuck
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About StephenBuck
04-18-2023
11Posts
1Like
0Solutions
Apr 18, 2023Last Visited
User
Activity
User
Profile
Latest posts by StephenBuck
| Subject | Views | Posted |
|---|---|---|
| 898 | 11-28-2021 07:54 PM | |
| 3046 | 11-28-2021 07:52 PM | |
| 3153 | 11-25-2021 06:55 PM | |
| 3444 | 11-22-2021 01:33 PM | |
| 3630 | 11-11-2021 10:29 AM | |
| 4528 | 11-10-2021 05:00 PM | |
| 2842 | 06-23-2019 01:31 PM | |
| 3699 | 06-23-2019 01:15 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 11-10-2021 05:00 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like | |||
| 2 Likes |
User Badges
Community Statistics
| Member Since | 05-01-2017 08:35 PM |
| Date Last Visited | 04-18-2023 01:17 PM |
| Posts | 11 |
| Total Likes Received | 1 |
11-28-2021
07:54 PM
I do the same thing and have my ISPs in their own virtual router and use BGP to advertise the default route to the internal VR since you can't peer between VRs using OSPF.
... View more
11-28-2021
07:52 PM
One of my ISPs has a lease time of only one hour. The Palo renews just fine as long as there isn't any issue between it and the DHCP server. If there's a short outage that lasts longer than an hour, that's when I noticed a problem before changing my script. When the lease expired and the Palo was unable to renew a new IP, the interface would show 0.0.0.0 for the next hop gateway.
... View more
11-25-2021
06:55 PM
I forgot to mention that I did turn off the option to auto insert the default gateway from DHCP. My script simply queries the DHCP interface to get the gateway handed out by the DHCP server and I set the next hop to this address. That's what started all this since the script would put in a 0.0.0.0 for the next hop when there is no address on the interface (DHCP lease expired and there was no connectivity with the ISP).
... View more
11-22-2021
01:33 PM
TAC advised that this is expected behavior since the underlying Linux pings to 0.0.0.0 are succeeding. I've verified with my script that setting the next hop to 254.254.254.254 will cause the path monitor to fail when there is no DHCP address on the interface.
... View more
11-11-2021
10:29 AM
Thanks @aleksandar.astardzhiev I'm going to be checking for null or 0.0.0.0 and replace it with 254.254.254.254 which seems to work. In the meantime, I've opened a TAC case and waiting to see what they say. Would definitely require a code change in PAN-OS to prevent replies to 0.0.0, or prevent 0.0.0.0 as a next-hop, and in the latter case, my script would fail to commit a 0.0.0.0 and so would need to be modified anyway.
... View more
11-10-2021
05:00 PM
1 Kudo
I'm running PAN-OS 10.1 on a VM-100. I have DHCP on an interface and use a script to update an address object with the default gateway from the DHCP interface. I have a static route with next hop set to this address object and path monitoring enabled. I've run into a situation where if the DHCP lease expires (something upstream fails with the provider), then the address object gets set to 0.0.0.0. The path monitor still shows up when using the next hop of 0.0.0.0. I can reproduce this easily by creating a static route to 9.9.9.9 with next hop of 254.254.254.254 and it shows down. With a next hop of 0.0.0.0 it shows with a status of UP. Is this expected behavior?
... View more
06-23-2019
01:31 PM
What I've found is that when I commit changes to Panorama made by a specific user, only those committed changes get pushed to the device group specified. If there are other uncommitted changes made by other admins, those don't get pushed out during the commit-all. I do agree with you that any other committed changes made by other admins will also be pushed out with the commit-all. In the GUI, there's no option to push only the changes made by a single admin out to a device group, only to commit to Panorama the changes made by a single admin.
... View more
06-23-2019
01:15 PM
This should work. I have a script that is tied to a specific user via the API key and whenever it runs to update an address, I have the script only commit the changes made by this user. In my script, I define the $ADMIN variable as my api user. /api/?&type=commit&action=partial&cmd=<commit><partial><admin><member>$ADMIN</member></admin></partial></commit>
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-18-2023
01:17 PM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks