About cstech

Please correct any wrong statements: 1. I connect my PA to the "untrust internet" via ethernet 1/1 2. My ISP assigned me 164.67.80.0/24 block of IPV4 addresses (actually this is a lie...) 3. I assigned 164.67.80.2/24 to ethernet 1/1 4. The PA is capable of running NAT on any of the addresses in the entire 164.67.80.0/24 subnet using Proxy ARP 5. I want to run a GlobalProtect HTTPS server on 164.67.80.3 6. The GlobalProtect Portal will not allow (5). 7. The reason for (6) is that 164.67.80.3 is not bound to ethernet 1/1.  The GlobalProtect HTTPS portal cannot use Proxy ARP. 7. I cannot bind 164.67.80.3/24 to ethernet 1/1 as a subinterface because it is on the same subnet as 164.67.80.1/24 8. I cannot run my GlobalConnect portal on 164.67.80.3, my preferred IP address 9. I must run GlobalConnect HTTPS Portal on the un-preferred IP address 164.67.80.2. Thank you, Chris ... View more

Hello, 1. I have three zones: Public, DMZ, Private Public interface: bound to 164.67.80.124/26 Private interface: bound to 192.168.1.1/24 DMZ interface: bound to 192.168.2.1/24 2. I use bi-directional NAT to expose a few of the DMZ machines via their own public IP addresses: 164.67.80.77 <-> 192.168.2.77 164.67.80.78 <-> 192.168.2.78 164.67.80.79 <-> 192.168.2.79 Example: Source zone: DMZ Destination zone: Public Destination Interface: any Source Address: 192.168.2.77 Destination Address: any Service: any Source Translation: static-ip, 164.67.80.77, bi-directional: yes Destination Translation: none 3. I add security policies to allow the DMZ machines to access the internet and be accessed from the internet. 4. None of my interfaces are explicitly bound to 164.67.80.77, 78, or 79.  This works due to something called "Proxy ARP" on the public interface (as explained to me in these discussion forums). 5. I add a "Source NAT" policy with the intention of providing internet access to the Private zone: Source zone: Private Destination zone: Public Destination Interface: any Source Address: any Destination Address: any Service: any Source Translation: dynamic-ip-and-port, 164.67.80.124 Destination Translation: none 6. I don't yet add a security policy to allow Private machines to the Public zone. 7. After step 5, the communication between the DMZ and Public stops.  Internet cannot access the DMZ machines via the public IP addresses and the DMZ cannot access the internet. Question: Why does the DMZ stop working when I perform step 5? Thank you, Chris ... View more

The PAN-OS Administrator's Guide for version 6.0 gives a description of setting up SSL Inbound Inspection on page 295.  In step 2, it instructs to import the target's certificate.  In step 4 it instructs to create a decryption policy by specifying the destination address of the targeted server. Questions: 1. Doesn't the PA require the encryption key, not just the encryption certificate to perform inbound SSL inspection? 2. In the case where the server to be inspected is running in a DMZ behind a bi-directional NAT (and the policy is for Trust->DMZ), should the destination address be the public or private IP? 3. How do you know the answer to (2)?  Is there a section in the administrator's guide that spells this out?  I would like to learn more about this so that I can figure out the answer to those sorts of questions on my own. Thank you, Chris ... View more

Hello, What does it mean to attach the "default antivirus profile" to a deny policy?  Does that mean that traffic matching that rule will be both denied and scanned for viruses?  (I have the same question for the other profiles too). Thank you, Chris ... View more

Hello, I have /26 public IP addresses (164.67.80.65 - 164.67.80.126).  I bound ethernet 1/1 to 164.67.80.77/24.  Then I created a bidirectional NAT connecting 164.67.80.77 to 192.168.1.77.  Works great.  Now I want to setup a second bidirectional NAT: 164.67.80.78 to 192.168.1.78 Question: Can I do this without using just the one external interface?  Can I "add" 164.67.80.78/24 to interface ethernet 1/1, eventhough it already has an address on the same subnet 164.67.80.77/24? Thank you, Chris ... View more

Hello, I have an address I would like to represent as an "Address Object".  The address is 164.67.80.78 and the netmask is 255.255.255.192.  I created an "Address Object" with an "IP Netmask" of 164.67.80.78/26. I used this "Address Object" to set the interface address.  Worked great.  When I went to setup a bi-directional NAT policy, I needed to specify a "Source Translated Address".  This address must be 164.67.80.78/32 and cannot be 164.67.80.78/26.  i.e. the "Address Object" I created would not work for the NAT policy. So I created two address objects: one for 164.67.80.78/26 and another for 164.67.80.78/32.  I am not happy about the duplication.  Is there a better approach? Thank you, Chris ... View more

"show system resources" indicates CPU is 80% idle... yet can take 90 seconds to display results.  Logging into the web interface can take 60 seconds.  Committing insignificant changes can take 5 minutes (Maybe this is excusable) . These are not exaggerations. How can I troubleshoot the source of this latency?  I'd love to hear an responses such as "you don't have logging turned on, do you?  go turn it off!" or "get used to it, we all have that problem". I'm running 6.0.2. Thank you, Chris ... View more