Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About rob.burgoyne
About rob.burgoyne
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
01-04-2018
48Posts
1Like
0Solutions
Jan 04, 2018Last Visited
User
Activity
User
Profile
Latest posts by rob.burgoyne
| Subject | Views | Posted |
|---|---|---|
| 463 | 07-25-2014 11:22 AM | |
| 1313 | 04-24-2014 03:57 PM | |
| 346 | 05-15-2013 01:09 AM | |
| 673 | 05-09-2013 01:08 AM | |
| 1089 | 05-08-2013 06:48 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 | 05-15-2012 12:00 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 |
User Badges
Public Statistics
| Date Registered | 10-19-2010 05:38 PM |
| Date Last Visited | 01-04-2018 06:52 PM |
| Total Messages Posted | 50 |
| Total Likes Received | 1 |
07-25-2014
11:22 AM
We have a pair of 5050s that we recently tried to upgrade, however we ran into an issue where once both of the PANs were upgraded they went into split brain. Its currently setup with some basic HA active/standby settings for 5.0. so I'm not sure why this would change in 6.0.3. We had to roll back to stay within our maintance window. Has anyone else had issues with HA after upgrading? Thanks,
... View more
04-24-2014
03:57 PM
I have a customer that is asking if its possible to assign static addresses to VPN users. This is required because of existing upstream firewalls that have ACLs tied to source IP addresses. This is done so that users can VPN into the network and then gain access to specific resources that are managed by a different group. I was wondering if anyone has ran into this scenario before and if there was a solution. I was also wondering if it was possible for VPN users to get DHCP from a DHCP server instead of the PAN Firewall. It doesn't look like this is possible but I thought I would check. Thanks,
... View more
Labels:
05-15-2013
01:09 AM
I am looking for this exact configuration. Were you able to get it working as expected using PBF?
... View more
05-09-2013
01:08 AM
Hey guys I am having an issue with a 2 x 10Gb (vPC) port-channel between two Nexus 5548s and a PAN 5050. I can get the port channel to come up on both switches, however I get around 25% packet loss when pinging over it. I have changed the port channel load balancing to src-dst-ip and have tried a couple different configurations on the cisco side with no resolve. As soon as I shut one side of the vPC down it cleans up. PAN: 5.1.5 Nexus: 6.0.2 Both sides of the vPC are configured the same and show up. description PAN5050 switchport mode trunk switchport trunk allowed vlan 128,135,159 channel-group 201 description PAN5050 switchport mode trunk switchport trunk allowed vlan 128,135,159 vpc 201 SW-1: 201 Po201(SU) Eth NONE Eth1/1(P) SW-2 201 Po201(SU) Eth NONE Eth1/1(P)
... View more
05-08-2013
06:48 PM
Hey guys I am having an issue with a 2 x 10Gb (vPC) port-channel between two Nexus 5548s and a PAN 5050. I can get the port channel to come up on both switches, however I get around 25% packet loss when pinging over it. I have changed the port channel load balancing to src-dst-ip and have tried a couple different configurations on the cisco side with no resolve. As soon as I shut one side of the vPC down it cleans up. PAN: 5.1.5 Nexus: 6.0.2 Both sides of the vPC are configured the same and show up. description PAN5050 switchport mode trunk switchport trunk allowed vlan 128,135,159 channel-group 201 description PAN5050 switchport mode trunk switchport trunk allowed vlan 128,135,159 vpc 201 SW-1: 201 Po201(SU) Eth NONE Eth1/1(P) SW-2 201 Po201(SU) Eth NONE Eth1/1(P)
... View more
Labels:
02-06-2013
05:04 PM
I am getting ready to move two 5050s into production and would like to know what release code to start with based on your recommendations. I assume that 4.1.10 would be the best choice, but 5.0 has been out for a little while now. I normally wait for about 4 or 5 releases before moving to the next revision. Thanks for the info.
... View more
Labels:
11-01-2012
01:11 AM
That sucks, it would be really nice to be able to easily filter routes based on Areas, not really how OSPF was designed but doesn't seem like it would be that hard for them to implement something like this.
... View more
08-10-2012
03:23 PM
Right so in this configuration, if 10.100.10.50 is going to anything in the (address group) it will get translated to 209.165.241.88. And then ANYTHING hitting 209.165.241.88 from the outside will get translated to 10.100.10.50 according to my lab. What I wanted was for the source of the inbound to be limited to only the (address group). To accomplish this I need a second destination NAT for it to work how I want. Thanks again for the help!
... View more
08-10-2012
11:58 AM
Ok so I was able to Lab this up and these are the results. Original Packet Source: 192.168.1.254 (INSIDE) Destination: SERVER GROUP (OUTSIDE) Source Static Translation 172.16.1.1 (OUTSIDE) Bi-Directional - Yes Ok so on workstation 192.168.1.254 I am able to ping all of the IP's in the server group and NAT looks to be working correctly outbound. If I try to ping anything other than the server group it fails as expected (since it doesn't match destination). However I am then able to ping (192.168.1.254) from anything via (172.16.1.1) inbound. I was hoping that it would only NAT it if the source was from the server group, which is not the case. So it looks as though I have to disable bi-directional and manually create a destination NAT sourced from SERVER GROUP destination 172.16.1.1
... View more
08-09-2012
10:56 AM
I have the following rule in the firewall and was wondering if I needed to create a second rule for the other direction or if the bi-directional option will take care of it for me. example source address :10.100.10.50 > destination address: FTPSERVERSGROUP > Source Translation: static-ip 209.165.241.88 bi-directional Basically if 10.100.10.50 is going to any of the IPs in the FTPSERVERSGROUP I want it to get translated to 209.165.241.88, and I also want the flip of anything coming from FTPSERVERSGROUP to 209.165.241.88 get translated to 192.168.1.10. I just want to make sure I don't need a source translation and then a destination translation or if the bi-directional option will take care of it....
... View more
- Tags:
- nat
Labels:
08-02-2012
05:37 PM
Is there a way for PAN to auto-number policies, for example I would like to name my policy EXAMPLE-1, and have it enter the number sequentially for me. I can manually "name" them, but if someone inserts a rule or rules need to get moved around it gets pretty confusing. It would be nice if there was a number assigned to each policy line, or at least make a wildcard that would renumber itself eg EXAMPLE-*. I was just wondering before I submit a feature request. Tha
... View more
Labels:
08-02-2012
10:20 AM
mp - 1.3.6.1.2.1.25.3.3.1.2.1 ----- value = 0.0 dp-0- 1.3.6.1.2.1.25.3.3.1.2.2 ----- value = 1 dp-1- 1.3.6.1.2.1.25.3.3.1.2.3----- value = not supported Hrm, can't seem to get it to work. Any tricks that I should know about?
... View more
08-01-2012
05:58 PM
I'm looking for an OID to use for monitoring the CPU/MEMORY utilization with my NMS system. My MIB walk didn't turn up anything useful. Thanks,
... View more
Labels:
06-12-2012
12:04 PM
05-15-2012
12:00 PM
1 Kudo
The first question would be, do you guys have a global protect license? If you don't then you wouldn't be able to use the detect gateway features. You should be able to remove the internal gateway from the GP configuration and you should no longer see that error message. The detect gateway feature is only avlaible for licensed global protect. Its confusing because you still use the GP client if you don't have it licensed but it will only act as an SSL client without the additonal feature set.
... View more
04-10-2012
09:22 PM
This worked, thank you for the help!
... View more
04-10-2012
06:24 PM
I don't receive a commit warning when I leave the ip address blank. I will do some more testing tonight. Thanks for the response!
... View more
04-10-2012
06:07 PM
I have a 4050 configured up with two seperate vsys that have two seperate virtual routers connected to two seperate internet connections in my lab. One internet connection is a cable modem with a static ip address Eth9, the other is a PPPoE DSL modem with a static IP address Eth1. I had an issue where I wasn't able to select the PPPoE interface IP under the global protection gateway until I selected the static option under (advanced). I was able to setup a site to site vpn using the cable modem vsys but I am having issues with the PPPoE side. The only difference is that i have configured global protect portal and gateway on the PPPoE vsys. Under the SSL VPN configuration I do have IPSEC enabled and I am able to use ipsec on my clients. I'm having a hard time configuring up the IKE gateway for my ipsec tunnel. Normally I see the public address in the dropdown box for the interface that I want to use. I've included a screen shot of the differences. I haven't tried selecting the interface without an ip address to see if that works, thanks for the response.
... View more
04-07-2012
11:43 PM
I am in the process of configuring a site to site vpn but when I try and select my public ipaddress (outside interface) for the local ip in the ike gateway setup the ip address is not avalible as an option. I assume this is because its already configured for my global protect gateway and portal? Is this possibly the issue? Currently the portal and the SSL-VPN are working correctly. I only have a single public address, would it be possible to resolve this by doing some destination NATs to a loopback or something on another port for captive portal? Maybe I'm missing something.... Also my outside interface is setup as PPPoE but its configrured as static in the advanced settings. I am running code 4.1.4. Thanks,
... View more
01-16-2012
08:34 PM
Yes exactly, its really annoying and I only started seeing it after we upgraded to 4.0.8. It doesn't change the object in the NAT, ACL, or Address Groups. You litereally have to go to each one and re-enter the correct name. Otherwise you get an error when trying to commit that says no refrence found for XX. I have about 150 objects that need to have their names changed with our new standard...
... View more
01-16-2012
04:31 PM
I used to be able to make changes to objects (address/groups/application groups) ect. But now when I made the change I have to go through my policies and NATs and update them manually. Any ideas? Is there an update object option that I'm not aware of?
... View more
12-29-2011
05:49 PM
Apple remote desktop seems like a pretty widely used application. I really hope palo alto has this in their app-id database...
... View more
12-29-2011
03:17 PM
Remote Desktop Protocol (RDP) is a multi-channel protocol that allows a user to connect to a networked computer. Clients exist for most versions of Windows (including handheld versions), Linux/Unix, Mac OS X and other modern operating systems. The server listens by default on TCP port 3389. Microsoft refers to the official RDP server software as Terminal Services or Remote Desktop Services. The official client software is referred to as either Remote Desktop Connection (RDC) or Terminal Services Client (TSC). Mac OS X's client is called Apple Remote Desktop (ARD). I found this for the description for MS-RDP but I can't figure out if thats what I use to classify ARD or not. The ports don't look correct and currently I don't have a way to test the traffic. Any ideas? Thanks,
... View more
12-13-2011
12:22 PM
I found another thread on this issue... https://live.paloaltonetworks.com/message/7813#7813
... View more
12-13-2011
11:58 AM
Its pretty odd considering I haven't seen this issue with any other customer's network that has had agents deployed. This customer however does have exchange where the other customers did not. Does exchange itself have something to do with it? The traffic between the agent and the firewall is really minimal but the traffic between sites is causing some issues. At this point the only solution I can think of is to install an agent on every DC. Not sure if there are any caveats with doing this...?
... View more
12-07-2011
09:19 PM
I installed the PAN user agent on a customers core DC and we are now having some issues. The traffic between the DC with the user agent and the firewall is pretty minimal and everything is working correctly. However we are seeing a lot of additional traffic ( consistent 1Mbps+) between their core DC (where the agent is installed), and their edge DCs that wasn't present before the install. Has anyone else experienced this before? I have installed the agent on several customer networks without any issues, but they were quite a bit smaller domains.
... View more
11-02-2011
09:56 AM
Does anyone have a good step by step guide on setting up the 4.1 Pan Agent? The admin guide wasn't much help. I'm getting a no certificate error in the monitor logs of the Agent. Thanks,
... View more
Latest Blogs
Latest Posts
Copyright 2007 - 2020 - Palo Alto Networks
