About RobinClayton

No but Sectigo certs on some sites are failing even with expiration turned off 😞   Rob  ... View more

So something has been BROKEN again..   I did think updates were set to the external interface on the service router, but  I may have changed that after the updates were broken back in that autumn (northern hemi)...  With the SR for Palo Networks set on the external interface I am picking up  updates once more.. ... View more

Integrated FW/Router has been the norm for home connections for ever.    Often for business connections the service has been wires+routers but wires only is becoming more prevalent. so long as your service provider is happy to provide connection details then there is no reason to need their router.   Our main PA had both a wires only + routed connection for some time until we dropped the wires only connection.   Our other PA is on managed routers but we are going to wire only but using our own routers.... Maybe i will think on if the routers are actually needed.. ... View more

Response to my case. ------------------------------     Good day! Engineering has identified on the fix, and it is coming in upcoming releases of all major releases ie. 8.1.15, 9.0.9, 9.1.3. With the fix, we will evaluate the leaf node, and chain up to trust store. Tentative ETA is around Mid-June. I would also like to update you that we have put together a customer advisory if you would like to take a look - https://live.paloaltonetworks.com/t5/customer-advisories/decryption-errors-created-by-the-expired-addtrust-external-root/ta-p/330976 ... View more

I have expiration turned off at present , support are not being very clear. will turn it on again later and see if the cert store has updated. ... View more

From PA Support   " From a quick search, I was able to see that multiple issues have been reported with respect to Sectigo Certificates Expiration. As a workaround,you can either allow untrust cert or exclude the website from decryption which is causing issue. PA has updated with the latest CA certification, so as of now no action needed on PA certificate store. If server chain is not updated till now then that might cause issue here. Please let me know if you have any further queries or concerns regarding the case."   Awaiting their guidance on why the store is not up to date.   Rob   ... View more

The fact that https://support.sectigo.com fails as well leads me to believe that the test site is not able to correctly process the request. ... View more

Yes we are seeing this issue     Some customers are reporting it too when accessing one of our websites, but that's an external problem     I can't replicate it accessing our site externally.   I don't think it's necessarily a web hoster problem, our chain looks valid, and the certificate was only generated with it's chain in December.   I have logged a support case, I suggest you do the same.   ... View more

Any idea when the bug was introduced, I have tried searching and all I get is that it was fixed in 8.1.14.  ... View more

The alternative is to configure your MTA to accept unauthenticated SMTP from the address of the Firewall.   Rob ... View more

"Monitor", "Mirror" or "SPAN" are the general terms your probably looking for..   All our switch traffic is mirrored out to the PA Tap interface for inspection.      ... View more

Monitor to where?   You can send system SYSLOGS that should alert to ports going down. ... View more

Otakar eludes to the V-Wire, which would allow traffic to traverse the PA seamlessly, but in that scenario, as he points out, you would need bot a trusted and untrusted v-wire ports. And the untrusted v-wire and external interface still both need to connect to the Leased line somehow.   The present setup is really correct for most instances.    Or are you trying to get rid of £$  threat inspection licences on the checkpoint and put that into the PA??   Rob         ... View more

If one connects and the other does not then it's not the user itself.   Ensure CIMv2 is setup correctly as that's one usually missed.   https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGGCA0     ... View more

So the L2 Switch has the   Internet on one port. PA on another port Checkpoint on another port.    All there  in the same vlan.   Personally that's how I intend my external infrastructure to be, I can then have multiple ISP's and trusted their part circuits  on different VLANS going to any combination of firewalls.   ... View more

If the other firewall has  5.X.X.34 , then it's going to conflict if both are the same?? Or are you getting rid of the other firewall?   Rob ... View more

is it possible to try with SFTP.   There are numerous threads on the internet over the years relating to SCP being slow ( nothing to do with firewalls ).  I have seen it connecting to a local server where SCP is slow and SFTP significantly faster (or actually normal).   Rob ... View more

Best practice, is to fail traffic to the passive as the first step after disabling pre-empt(personally I have it off all the time anyway.)   Then step through each iteration, switching firewalls at each step to confirm the upgrade is successful and traffic still passes.   From what you say you have upgraded the passive all the way in one go. You could disable pre-empt now and fail the traffic over and see if it works but your more likely to see and issue.    Better option would be to downgrade the passive and then fail over to it and do one step at a time on each. That way they are only ever one version different be it Major, Minor or Increment.   ... View more

It was set on the MGMT interface, but I did not see any CRL/OSCP app-id traffic.   I now have it configured for CRL Service on the external interface, but that made no difference.  ... View more