About Fr4nk4

Does anybody know how to mitigate this vulnerability? This is being detected on our PA-3020 series firewalls running PAN OS 8.1.13. ... View more

We have a PA-3020 firewall pair that has multiple IPsec tunnels to a VM series pair in AWS. We have 4 IPsec tunnels that we run to the firewalls. They are: Tunnel A - On Prem to AWS FW1 over Direct Connect Tunnel B - On Prem to AWS FW2 over Direct Connect Tunnel C - On Prem to AWS FW1 over Public Internet Tunnel D - On Prem to AWS FW1 over Public Internet We also have BGP routing in place and peer with the AWS FW1 and FW2. If I test killing BGP on FW1 in AWS, our PA-3020 automatically routes traffic to Tunnel B, and within 15 seconds, we are sending traffic to/from FW2. That part works perfectly. However, if I down Tunnel A from the AWS side, we stay down indefinitely. BGP knows to send traffic to Tunnel B, but communication over Tunnel B does not occur. Security policies on the on prem firewall and AWS FW1 and FW2 allow for BGP and IPSec communication for all the tunnels. I have tried Static Route monitoring, where you create the same route for the AWS traffic, but create different Metrics for each route which would use different tunnels. For example: 172.16.0.0/16 Route A 172.16.0.0/16 via Tunnel A Metric 10 Route B 172.16.0.0/16 via Tunnel B Metric 15 Route C 172.16.0.0/16 via Tunnel C Metric 20 Route D 172.16.0.0/16 via Tunnel D Metric 10 I have also enabled tunnel monitoring, and allowed pings to/from each firewall. I know that the static routes are no longer required since we use BGP, but what would be the preferred method in order to get the on prem firewall to automatically use Tunnel B if Tunnel A went down? Would a PBF profile be in order? ... View more

Has anybody migrated Panorama from on prem to AWS? There are a few options that are available to us, and I am trying to decide which option is the best. Also, if you can list any "gotchas" during the migration that would benefit us, that would be really helpful. These are the options that I see.   Option 1:  Use SRM and our connected VMware on Cloud to move the server from our on premise Vcenter to VMware on Cloud, which is in AWS and connected to the rest of our infrastructure. This is the easiest and quickest option, but Panorama's 3-6TB of log storage can be very costly, and we will be migrating off of the VMware on Cloud Platform in 5 years anyway.    Option 2: Use AWS Connector for Vcenter to replicate Panorama into an Amazon EC2 instance. I don't believe this to be a recommended practice, plus I am not sure how licensing would work after this is done.   Option 3: Deploy the Panorama BYOL AMI from the AWS Marketplace and build the AWS Panorama instance from scratch, and import the licensing, and all the firewalls and configs. This seems like the most work to do, but is recommended by PA.  ... View more

Hiya!   Does anybody have a script that automates PAN OS Upgrade on firewall pairs? If so, can you share one with me? I need to be able to run a script that can upgrade 4 firewall pairs. We are using Panorama as well.  ... View more

So, we are in the process of creating a prescence in AWS. We are planning on using a pair of VM-300 series firewalls (jn Active/Active) in a Transit VPC. Our on prem firewall pair (in Active/Standby mode) will connect to the Transit VPC via IPSEC tunnels. The first tunnel will be over a DirectConnect (DX) connection, and the second tunnel will ride over the public internet (in case the DX connection fails). So basically, each firewall will have 2 IPSEC VPN tunnels going to AWS.   While the Transit VPC IPSEC tunnels in Active/Active mode are fine to have different IPSEC tunnels going to them, I am wondering how this will work on the on prem firewalls being as though the tunnel only works on the Active firewall. What would be the best way to make this work? ... View more

My company has 2 PA-3020 firewalls in Active/Passive configuration. They were purchased way before I started working here, so I had no input on the model that was selected. We have about 500 users in our network, and about 800 devices.   In our environment, these firewalls sit at the perimeter edge, and there are no internal firewalls (for network segmentation). We are not running ACI or VMware NSX either.   Up until about a year ago, the company was using this as a state full firewall, but had purchased all of the licenses. Since I've been here, we've been tacking on more things to the firewall such as Network Segmentation (16 security zones), and GlobalProtect VPN (for about 5 users).   We would like to start using some of the IPS features such as WildFire, Zone Based Protection, and last but not least, SSL decryption. I've been told from one source that the PA-3020's are not great at SSL decryption, and I would like to ask You, The Palo Alto community, if you think that is the case. I would like to know if getting a beff-ier firewall would be best, or if we can still use the PA-3020. Any insight you can offer would be greatly appreciated. ... View more

Guys,   I've been having this wierd issue with GLobalprotect for almost 3 months staraight with no possible way to fix it. I will connect to my company's SSL VPN with the Globalprotect client, and I have no issues connecting. The issue comes usually about an hour after I am connected. All of a sudden, sessions will cease to exist. I'm still connected to the VPN, but now my Outlook is diconnected, I can't ping 8.8.8.8, and my IM client can't connect at all.   From what I'm told from TAC, the HIP checks that we have in place to make sure it is a company laptop and not a BYOD device, is timing out. It scans at initial login, and does a follow up scan later, which is where I run into this issue. It times out for almost 20 minutes before regaining access to the network again. Alternatively, I can force it to come back by opening the client, and clicking the Resubmit Host Profile button, and about 30 seconds later we're back in business.    We used to have a bunch of HIP objects including Host Info, Custom check, Antivirus, Windows OS Patches, SCEP. Over the last 2 months I have taken all but the host info and custom check out of the system, and I still have this issue. It's not just me either, 2 other users out of 6 have complained about it.    I've often wondered if maybe our PA3020's are just FUBAR, or if there is something bigger at play going on. Coming from using Cisco ASA's extensively and using Anyconnect, I couldn't recommend Globalprotect to anyone right now. Has anybody else had any similar issues???  We're using PA3020s with PAN OS 8.1.6.       ... View more