Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Get Started
- News & Events
- Collaboration
- Education Services
- Technologies
- Next-Generation Firewall
- GlobalProtect
- Threat Prevention Services
- Endpoint Protection
- SSL Decryption
- App-ID
- Content-ID
- User-ID
- 5G
- IoT Security
- Cloud Identity Engine
- Panorama
Network Security
- Prisma Access
- Prisma Cloud
- Prisma SD-WAN
- CN-Series
- VM-Series:
- OCI
- Alibaba
- AWS
- GCP
- Azure
Cloud Security
- Cortex XDR
- Cortex XSOAR
- Cortex Data Lake
- Cortex Xpanse
Security Operations
- Resources
- COVID-19 Response Center
About michelle79
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- LIVEcommunity
- About michelle79
10-19-2020
8Posts
1Like
0Solutions
Oct 19, 2020Last Visited
User
Activity
User
Profile
Latest posts by michelle79
| Subject | Views | Posted |
|---|---|---|
| 1518 | 12-08-2019 08:12 PM | |
| 1192 | 12-03-2018 02:26 PM | |
| 1198 | 12-03-2018 02:04 PM | |
| 1210 | 12-02-2018 10:03 PM | |
| 663 | 07-01-2018 11:44 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 03-04-2018 08:14 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 2 Likes | |||
| 1 Like |
User Badges
Community Statistics
| Member Since | 11-20-2017 07:00 PM |
| Date Last Visited | 10-19-2020 09:43 PM |
| Posts | 8 |
| Total Likes Received | 1 |
12-08-2019
08:12 PM
Hello, can someone please tell me the best way to implement minemeld custom IP and URL blacklists? We have just built a minemeld server and have both a list of IPs and URLs. Currently have just one OUT rule like below but should we have 2 - 1 for IP destination and 1 for ANY destination but for particular URL category? We are unsure if the URL category will match only if the destination IP matches or if they are applied in an IP OR URL type situation.
... View more
12-03-2018
02:26 PM
Hmmm ok perhaps this is why the engineer implemented the HA in the current layout then. Given we already have the backup PAN at the remote site then it is probably not necessary to screw with the HA config - unless of course this is required in order for me to set up the redundant ISP?
... View more
12-03-2018
02:04 PM
Thanks for such a quick response! We do have an active/passive HA on the Primary PAN but I was told that for HA to work they need to be connected via a L2 connection so for us I don't think it's possible to have HA between primary and backup PAN's as we have a L3 WAN only. Please correct me if this is wrong and I will follow up with the engineer that implemented the HA. So we currently have 2 physical PANs in A/P HA at Primary site and 1 virtual PAN at backup site.
... View more
12-02-2018
10:03 PM
Hi, I have read a few articles regarding internet redundancy using a primary and backup ISP link on a single Palo but can someone please explain (if it's possible) how one might achieve redundancy using a primary ISP link on 1 Palo with failover to a backup ISP link on another Palo at a remote WAN site connected to the primary site via L3? Cheers, Michelle
... View more
07-01-2018
11:44 PM
Hi all, I'm hoping someone can help me avoid a huge overhaul and outage window of our DMZ network... Our DMZ gateway is currently a Palo interface with GlobalProtect enabled on it. Servers on the DMZ are at a remote site connected via a Layer 2 spanned VLAN. We intend to decommission this L2 link and move to a L3 VPN service. We have an entire public class C IP range to play with but I am a little stuck as to how to manage this transition as smoothly as possibly. Am I able to simply advertise a /32 route to the DMZ gateway address for GlobalProtect VPN traffic and another static route to forward the /24 range to a dummy subnet that directs any remaining DMZ traffic over the L3 service? If I could get away with this then I guess I will need to assign an IP in the DMZ range to the router servicing the DMZ servers and modify gateway IPs on all DMZ servers to point to the new IP assignment but is there anything fundamental I haven't considered or may have overlooked? I'm concerned that I will need to start from scratch and split the /24 subnet up which in turn I think will mean many more VLANs and changes on the infrastructure hosting the DMZ servers that I would preferably like to avoid. Appreciate any advice or wisdom you can offer. TIA
... View more
03-04-2018
08:14 PM
1 Kudo
Hi reaper, I had suspected that this might be the case but wasn't really sure if it would be necessary. Anyways, I tried it and it works you little ripper!
... View more
03-04-2018
08:05 PM
Hi JamesWW, Thanks for taking the time to respond. Sorry it's taken a while to get back to you, I'm only part time here. As per the post by reaper, I ended up adding a PBF rule to the Palo to route traffic destined for the public subnet through to the public interface and that's worked. Thanks again for the time you took to help. Cheers, Michelle
... View more
02-26-2018
09:20 PM
Hi, so I've configured a new L3 subinterface on an existing L3 interface, both with IP addresses and I thought it was going to work. I've got a PBR rule in place on the previous hop, a HP switch, which diverts some traffic to this new subinterface. I can see the selected traffic allowed out from the Palo's traffic monitor logs but, from the client end, routing through the new subinterface I'm not getting responses back. A traceroute from the client to outside (or even the subinterface's primary interface) result in a response from the subinterface but no further. Out of desperation I added a static route on the Palo to ensure the return packets know how to get back but it's still not working. I've added a snippet of the network for a visual representation. Any ideas what I might have missed?
... View more
LEGAL NOTICES
Copyright 2007 - 2021 - Palo Alto Networks
