About nson2139

Team, On our Palo's we have a vsys defined and on this vsys we have 2 zones configured. ...... (say Trust zone and untrust zone.)   We have a server in the trust zone which need to monitor the interface allocated to the untrust zone. This does not happen i.e. the server is unable to telnet to the untrust interface(to the port we enabled) and hence monitoring fails.   However, the entire network can still do this telnet(i.e. network other than the trust side).   Any suggestions?   We unfortunately do not have packet capture rights to debug this and hence the question.     Thanks! N. ... View more

Folks, Similar to Cisco routers we are checking if we can form remote eBGP neighbors between Palo Altos located in different DC's. One PA is located in DC-01 and the second is located in DC-02   We are looking at this design to as both these Palo's form BGP on a IPSec tunnel to a customer location. As of now the failover is manual and we should be able to automate that is we can get a eBGP setup between these 2 firewalls.   Any suggestion on the eBGP part?   Regards, N! ... View more

Folks, For OSPF configuration on the Cisco router, we normally define a wild card mask.    e.g. network 1.1.1.0 0.0.0.255 area 0. What this configuration tells the Cisco router is to form OSPF neighbor with all IP address that being with 1.1.1.x IP address.   Do we have any option of configuring such a wild card mark on the Palo Alto firewall?   Or on the Palo Alto all we need to do is defined the interface with the correct subnet mask and that should take care of the configuration? I believe the later option is how it works.    Can someone help cofirm?   Regards, N!! ... View more

Folks, A policy based forwarding rule that we have created does not work. This pfb rule is create in vsys3 so we are not sure if any other configuration is needed.   When we try to see the running configuration for all pbf rules this is what it shows:   admin@hostname> show pbf rule all Server error : No PBF rule in vsys 1. admin@hostname>   Unlike a Cisco router does the PBF need to be applied anywhere? ... View more

Team, I am looking to gather some reports which will tell me how much traffic has been passed over a specific VPN tunnel on a Palo Alto. Is that possible? The preferred stats are over a month or a 15 day period.   If yes, can you guide me on how can I create these reports?     Thanks!!!     ... View more

Folks, we want to work on some specific BGP advertisements. Our aim is to propagate the deault-route to only on specific eBGP peer.   So far what we have already done is configured a static route redistribution profile.  This is done under "Redistribution Profile" under the particular virtual router.   The we have attached this "Redistribution Profile" under BGP --> Redistribute Rules. Here we see the option "Allow Redistribute Default Route".   However, this is something we do want want to do as it would apply to all BGP neighbours.  Instead, we want to send the default route only to selected neighbours.   How can we do that?     Thanks!!! N. ... View more

Folks, Our requriement is to allow specific URL's on SSL for outbound communication. Is there a need to purchase a URL filtering license for this requirement?   Regards, N!!! ... View more

Folks, can we have some scheduling done on logs which are being sent to a syslog server?   The traffic logs are so huge that they consume too much bandwidth when we send them to a central syslog.   It seems that they are all being sent when some buffer fills up. If my assumption is correct maybe there is some method to reduce the buffer size??   Thanks, N!!! ... View more