Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Live
- ›
- About nson2139
About nson2139
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
04-16-2020
33Posts
1Like
0Solutions
Apr 16, 2020Last Visited
User
Activity
User
Profile
Latest posts by nson2139
| Subject | Views | Posted |
|---|---|---|
| 324 | 02-12-2020 12:54 AM | |
| 879 | 07-11-2019 09:29 AM | |
| 1486 | 03-05-2019 12:09 AM | |
| 1487 | 03-04-2019 11:43 PM | |
| 1501 | 03-04-2019 09:00 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 | 11-29-2018 09:00 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 1 |
User Badges
Public Statistics
| Date Registered | 01-22-2018 11:44 PM |
| Date Last Visited | 04-16-2020 02:49 AM |
| Total Messages Posted | 35 |
| Total Likes Received | 1 |
02-12-2020
12:54 AM
Team, I am looking to gather some reports which will tell me how much traffic has been passed over a specific VPN tunnel on a Palo Alto. Is that possible? The preferred stats are over a month or a 15 day period. If yes, can you guide me on how can I create these reports? Thanks!!!
... View more
- Tags:
- reports
07-11-2019
09:29 AM
Folks, we want to work on some specific BGP advertisements. Our aim is to propagate the deault-route to only on specific eBGP peer. So far what we have already done is configured a static route redistribution profile. This is done under "Redistribution Profile" under the particular virtual router. The we have attached this "Redistribution Profile" under BGP --> Redistribute Rules. Here we see the option "Allow Redistribute Default Route". However, this is something we do want want to do as it would apply to all BGP neighbours. Instead, we want to send the default route only to selected neighbours. How can we do that? Thanks!!! N.
... View more
- Tags:
- bgp
- default route
03-05-2019
12:09 AM
sorry, I may not have made myself clear. What I meant is URL's as in, paloalto.com, microsoft.com etc. and all of those on port 443 only.
... View more
03-04-2019
11:43 PM
This will be inound traffic, but we need to control some traffic on a VPN.
... View more
03-04-2019
09:00 AM
Folks, Our requriement is to allow specific URL's on SSL for outbound communication. Is there a need to purchase a URL filtering license for this requirement? Regards, N!!!
... View more
01-18-2019
01:36 AM
Folks, can we have some scheduling done on logs which are being sent to a syslog server? The traffic logs are so huge that they consume too much bandwidth when we send them to a central syslog. It seems that they are all being sent when some buffer fills up. If my assumption is correct maybe there is some method to reduce the buffer size?? Thanks, N!!!
... View more
11-29-2018
09:13 PM
Folks, We configured a devices some fays back and it is now up and running. Our plan is to add this to the Panorama and replicate the same policies which will act as a template for other devices. What care needs to be taken so that the Panorama would not affect the existing configuration? (if that could happen). Eventually, all device will be managed by the Panorama. Regards,!!!
... View more
11-29-2018
09:00 PM
1 Kudo
bingo!!! this did the trick.
... View more
11-29-2018
04:36 AM
Folks, Typically when we build a IPSec tunnel from the AWS VPC to the on-prem Palo Alto box we get an option of 2 tunnel's from the AWS. I have options of configuring both the tunnels as UP/UP when the end point is something like a Juniper ISG-1000/ISG-2000 device. However, when I configured it on the PA-3260 only one of the tunnels is seen as up and the other is seen as down and this happens because the PA does not take equal routes to the destination on both tunnels.(at least that is what I seen). I wanted to check if it is something I did incorrect. Any suggestions/guideance? Thanks!!
... View more
10-26-2018
01:11 AM
ok, understood. However, do you see a potential issue that could occur in the ealier design? The firewall should still be able to keep session information if the packet comes inside over one path and goes out via the other, right?
... View more
10-25-2018
11:19 AM
yes, I agree. But in my case the switches are on a single interface. There is no point using the aggregate interfaces. 🙂 aggregate interface would be needed if they are also connected to the same switch ...right?
... View more
10-25-2018
09:28 AM
thanks for the comments mate!! Yes, it has to be virtual wire becuase we do not want to disturb anything in the existing setup. There is already routing protocols running between the switches and we want to retain that. The firewall should maintain the state table from one zone to the other, right? if yes, this should work without any challenges from what I think.
... View more
10-25-2018
08:32 AM
It gave me a warning saying "High-availability with ha2 configured should also be configured with state synchronization enabled(Module: ha_agent)" but immediately came up in the passive state." 🙂 This looks good, should the warning cause any challenges?
... View more
10-25-2018
06:55 AM
Folks, we have a switch to switch routing protocol running and the requirement is to put a palo alto in a vwire mode on such an environent. Please see the file attached with tis post. Now, the catch to this is the "switch-out" forms neighbours with "switch-01" and "switch-02" and packets going inside one link could come out of the other. I just wanted to ensure that this will not cause any packets drops as long as the zones are correctly configured. also, from a very high level what configuration would be needed? Convert each interface to a vwire? add the zones? add the policies? anything else? Thanks!!!
... View more
10-25-2018
06:48 AM
upgrading to 8.1.4 reduced the state changing time but it still takes around 1 hr.
... View more
10-25-2018
06:48 AM
upgrading to 8.1.4 reduced the state changing time but it still takes around 1 hr.
... View more
10-25-2018
01:46 AM
by very long I mean more than 4 hours.... I am not sure if that is normal. to configure the data link I do not have the hardware and this is not a requirement at this moment.
... View more
10-23-2018
04:56 AM
Folks, Our Active-Passive pair takes too long to show the status(i.e. active or passive) when one of the firewall is rebooted. i.e. as of now things are running fine, but if I reboot the passive firewall it will take a very long time to once again come up as passive. It goes through the "not ready" and "initial" stages before getting in the "passive" stage. These are PA-3260 boxes and I have used the ha1-a as the control link and the ha1-b port as the backup for control link. Only the control link has been used for this HA configuration. Please let me know if there are any suggestions on this and how could I work on overcoming the long time duration? Thanks!!!
... View more
09-13-2018
05:11 AM
Folks, some what confused on how to start with this. I went through all the documentation which talks about an IAM policiy and definining roles ubt am not able to get where to configure this. My requirement is to have a firewall with an untrust/trust interface and a management interface. I believe I will need an additional HA interfaces as well. The below link mentions about the policiy: https://www.paloaltonetworks.com/documentation/80/virtualization/virtualization/set-up-the-vm-series-firewall-on-aws/high-availability-for-vm-series-firewall-on-aws/iam-roles-for-ha Do I write the policy manually? And then attach this when I create the instances? Thanks!! N.
... View more
08-13-2018
06:28 AM
Team, We have a NAT pool configured for one of the ongoing requirements. Is there a way to force this pool to allocate IP address from start to end as per new requests come in? e.g. NAT pool configured is 10.10.10.1 to 10.10.10.10 IP source is anything between 192.168.10.1 to 192.168.10.10 We noticed that if the traffic source is 192.168.10.2 it could take an IP from anywhere in the NAT pool. I want to force it to take a first IP in the pool. Also is it possible to configure something which keeps the last octet static? (this may be too much to ask.) Thanks!!! N.
... View more
07-12-2018
04:11 AM
We are looking at some method where we can dynamically NAT subnets behind the Palo Alto Firewall to pick an IP address from the network defined on the external interface. e.g. I have the external IP address network defined as 10.100.100.0 /24. The IP address 10.100.100.20 is defined as the IP of the external interface. In the internal network we have about a few networks defined i.e. 10.10.10.0/24, 10.10.20.0/24, 10.10.30.0/24. We are looking at some configuration where we can do some dynamic NATting for these internal networks to pick up some IP address from the External network defined. Thanks!! N.
... View more
01-29-2018
06:14 AM
This has been resolved, we had some challenges in the corporate firewall which has been worked on.
... View more
01-29-2018
05:08 AM
yes, I tried those options. It gives an error saying: Server refused public-key signature despite accepting key! and then it goes ahead and asks for the admin password which should not be the case.
... View more
01-29-2018
04:49 AM
Team, it has been some days that we got our virtual Palo Alto in the AWS and were able to change password using the initial access and the ppk file. However, due to some issues we had to get another firewall provisioned and I am unable to recreate the steps we had done earlier. After the instance is provisioned we downloaded the .pem file, coverted it to the .ppk fiel using puttyGen. Once that was done went to the putty folder and accessing the firewall as: putty.exe -ssh -i "file.ppk" admin@Public IP. This is not working and I am wondering where we are going worng. Any comments?
... View more
01-29-2018
04:27 AM
Thanks for the comments Rashid, all the mentioned are already enabled. This still does not work. At this point we are kind of unable to understand the issue.
... View more
01-24-2018
05:59 AM
one more point, we tried a debug on the Juniper end and it shows a message as below: "Not found: 1st peer_ent that is used, with no peer IP, and right local IP." by any chance could it be that some tweak needed on the PAN end to ensure that it sends the peer IP?
... View more
01-24-2018
04:01 AM
BTW....I did not mention this. The VPC(which hosts the firewall) has 2 VPN's one to route the management subnet directly to the corporate and the second to route the Untrust interface to the corporate for actual data flow... would that cause any harm? Should I try to delete the management VPN and then give this a try?
... View more
01-24-2018
12:14 AM
yes, all these options have been tried out with no success so far. We are still hunting the options here if there is something very basic that we missed.
... View more
01-23-2018
10:31 PM
The above log I took was from the PAN device. This is the one which is showing the Private IP. The PAN is the initiator and it starts the VPN tunnel with it's private IP. Now, technically this IP should be NATTted by the AWS and the EIP should be forwarded to the Juniper. The Juniper does show the EIP in it's logs. 🙂 Is there a way to configure the PAN to send the EIP itself in the logs it sends to the Juniper?
... View more
01-23-2018
10:08 PM
It just shows failed due to timeout ====> PHASE-1 NEGOTIATION STARTED AS INITIATOR, MAIN MODE <==== ====> Initiated SA: a.b.c.d[500]-1.1.1.1[500] cookie:916a1f78c71fbe00:0000000000000000 <==== Failed SA: a.b.c.d[500]-1.1.1.1[500] cookie:916a1f78c71fbe00:0000000000000000 <==== Due to timeout. 2018-01-23 22:02:17.000 -0800 [INFO]: { 4: }: ====> PHASE-1 SA DELETED <==== Here the a.b.c.d is the private IP of the PAN Untrust interface and 1.1.1.1(changed) is the Juniper end IP. The Source/Destination checks have been turned off as per the guidance from the documents.
... View more
Latest Blogs
Latest Posts
Copyright 2007 - 2020 - Palo Alto Networks
