This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Cookie Policy. Click Preferences to customize your cookie settings.
About ROHO
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About ROHO
03-10-2023
16Posts
0Likes
1Solution
Mar 10, 2023Last Visited
User
Activity
User
Profile
Latest posts by ROHO
| Subject | Views | Posted |
|---|---|---|
| 7285 | 12-04-2018 06:36 PM | |
| 3470 | 11-07-2018 08:39 PM | |
| 3488 | 11-07-2018 02:20 PM | |
| 3220 | 11-05-2018 08:34 PM | |
| 2472 | 11-01-2018 12:26 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like |
User Badges
Community Statistics
| Member Since | 05-23-2017 02:29 PM |
| Date Last Visited | 03-10-2023 02:09 PM |
| Posts | 16 |
12-04-2018
06:36 PM
@Crispim I'm not sure if I understand correctly, on the PA-850, are you able to use 1G copper SFP on ports 5-8 (1G SFP only), and get link up?
... View more
11-07-2018
08:39 PM
The migration tool is building the security policy based on the private IP, post-NAT.
PAN matches based on pre-NAT, public IP.
In the NAT rule, the Security Rules Match does not have an entry. The first 4 reviewed has the same behavior.
What's interesting is that the migration tool prepends the NAT rule name with "Nat Twice" Not sure if there is a reasoning for it.
... View more
11-07-2018
02:20 PM
Not sure if anyone else ran into this.
ASA's security policies are built based on post-NAT rules (post 8.3 OS)
With the tool, it builds the same rules with the post-NAT rules, private IP ... which will not work with PAN as the rule is built based on post-NAT, public IP.
Is there an option in the tool to convert the IP to pre-NAT?
... View more
11-05-2018
08:34 PM
Noticed that many rules with source ports defined are not migrated over.
Instead, it creates a service only for the destination port/range and allows all ports through.
Below are a few rules. Is it a known behavior?
The first two allowed all udp and tcp ports > 1023
The third rule allowed all TCP ports
access-list OUT2IN extended permit udp any4 eq domain any4 gt 1023 access-list OUT2IN extended permit tcp any4 eq ftp-data any4 gt 1023 access-list OUT2IN extended permit tcp any4 eq ftp-data any4
... View more
11-01-2018
12:26 PM
We have quite a few Invalid Services. The only way to remove them is to remove all Unused Objects.
Is there a way to just remove the Invalid Services without having to remove all Unused Objects.
Looked in the ASA config and for the most part, they do not exist.
... View more
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks