About kpotru

Hi Guys my customer is in the heat of battle with policy and NAT review, but I wanted to toss something out there regarding the advertising/redistribution of the NAT space.    There’s some discussion on how to advertise the NATs (aka non-connected or routes not in local table), and I want to make sure we have a consensus.   Adding static routes versus using a redistribution rule?   It was discussed that we would need to add static routes for all the NATs, and set the next hop to whatever the “real” address uses.  As we are advertising statics, this would send the routes downstream.  Although I’m curious what that would do to the local route table, as the NAT IPs themselves are not technically “next-hop” routed.  I’ve never, personally, added static addresses for the NAT IPs, so I don’t have experience with this…which is why I ask the questions.  J   Is there a reason we wouldn’t just add the NAT addresses/subnets/whatever as an entry in the redistribution rules?  Aggregating where we can, or using host routes.     https://live.paloaltonetworks.com/t5/Configuration-Articles/BGP-Redistribution-Rules-to-Explicitly-Advertise-Host-Routes-and/ta-p/63123 Conceptually I had this idea, just didn’t know what “button to push”.    Customer need to advertise non-connected address space used by the NATs.  So I’m curious what the best practice would be.   Thanks in Advance. ... View more

For G-site rollout effort,is there a way to write Qos policies so they apply per client IP flow when they are communicating to google IP address?    A way to give rate limiting per client IP(thousands of clients) for google destination IP?     The keyword is per client,  so everyone has the same limited bandwidth.  Each client IP has 165kbp's 'allocated'      and they are limited to that speed.... ... View more

My requestors wants to perform Vulnerability scanning on the Palo Alto firewall devices and they want to whitelist the Qualys devices residing on ON-Prem. So my question is do i need to create security rule or make modifications to vunerability or allow those scanners on the management interface? They provided me the scanner IP's that they wan to whitelist. ... View more

Is it possible to use DG layering to solve DaaS Zone issue?? 1. Can we create a DG-DaaS whose parent will be ‘DG-AWS_DQA’. 2. Assign Seattle DQT firewall to DG-AWS_DQA 3. Assign Ashburn n future Chicago to DG-DaaS (since it has DG-AWS_DQA as parent, it will have both DaaS and DQT rules attached) Not sure if this will work or I’m missing basic configuration that needs to be taken care of. any ideas? ... View more

Is it possible to use DG layering to solve DaaS Zone issue?? 1. Can we create a DG-DaaS whose parent will be ‘DG-AWS_DQA’. 2. Assign Seattle DQT firewall to DG-AWS_DQA 3. Assign Ashburn n future Chicago to DG-DaaS (since it has DG-AWS_DQA as parent, it will have both DaaS and DQT rules attached) Not sure if this will work or I’m missing basic configuration that needs to be taken care of. any ideas? ... View more