About mkopcic

Hello!   Every few days I get this error and can't access knowledge base.    It is VERY FRUSTATING!!!!   Error started to appear after last tool upgrade. Does PAN have mailing list for resolving partner access issues?   Regards, Maja ... View more

Hi!   Does anybody know, if Network or Device configuration is changed localy on the firewall, will that change will be seen in Panorama automatically? Will firewall synchronize localy config changes with Panorama? For example. If I add new static route on the firewall (firewall is managed with Panorama), will that route will be synchronized with Panorama?   Thank you and best regards, Maja ... View more

Hello!   I have 2 PA-5020 with 5.0 software and want to upgrade them to 8.0. One way to do this is to follow upgrade procedure.   Configuration is very simple and can be deleted.   Is it possible to upload 8.0 software using GUI, boot firewall in maintenance mode and reset it to factory defaults using 8.0? Or is is possible to use FTP in maintenance mode to upload 8.0 and then reset it to factory defaults using 8.0?   Thank you and best regards, Maja Kopcic       ... View more

Hello!   This is the scenario and configuration that works on 8.0.3. It is implemented in our company.       Servers on public_dmz have public addresses and access Internet with that addresses. Only server with address 2.2.2.10 needs to be translated to 3.3.3.10 in both directions. 2.2.2.10 -> 3.3.3.10   Servers from private_dmz are published on the Internet using address from the address space used for public_dmz 2.2.2.0/24. They are using the same addresses when they are accessing Internet. For example: 10.10.10.20 -> 2.2.2.20   Hosts from LAN are published on the Internet using address from the address space 2.2.2.0/24. They are using the same addresses when they are accessing Internet. For example: 172.16.10.100 -> 2.2.2.100   One server from LAN has to be destination translated to 1.1.1.3. 192.168.3.3 -> 1.1.1.3       Basic routing ISP configured routes for 2.2.2.0/24 and 3.3.3.10/32 pointing to the PAN (1.1.1.2). PAN has default route pointing to the 1.1.1.1. Routes on PAN for LAN networks are pointing to the 172.16.1.2. Layer3 switch has default route to the 172.16.1.1.   NAT rules configuration NAT for server 2.2.2.10. Bi-directional NAT doesn’t work. Separate source and destination NAT rules must be configured.   Source NAT: Source zone: public_dmz Destination zone: Internet Destination interface: Eth1/1 Source IP: 2.2.2.10 Destination IP: any Source translation static: 3.3.3.10   Destination NAT: Source zone: Internet Destination zone: public_dmz Destination interface: Any Source IP: any Destination IP: 3.3.3.10 Destination translation: 2.2.2.10   NAT for server on the private_dmz. Bi-directional NAT doesn’t work. Separate source and destination NAT rules must be configured.   Source NAT: Source zone: private_dmz Destination zone: Internet Destination interface: Eth1/1 Source IP: 10.10.10.20 Destination IP: any Source translation static: 2.2.2.20   Destination NAT: Source zone: Internet Destination zone: private_dmz Destination interface: Any Source IP: any Destination IP: 2.2.2.20 Destination translation: 10.10.10.20   NAT for the first server on the LAN. Bi-directional NAT doesn’t work. Separate source and destination NAT rules must be configured.   Source NAT: Source zone: trust Destination zone: Internet Destination interface: Eth1/1 Source IP: 172.16.10.100 Destination IP: any Source translation static: 2.2.2.100   Destination NAT: Source zone: Internet Destination zone: trust Destination interface: Any Source IP: any Destination IP: 2.2.2.100 Destination translation: 172.16.10.100   NAT for the second server on the LAN.   Destination NAT: Source zone: Internet Destination zone: Internet Destination interface: any or Eth1/1 (works with both settings) Source IP: any Destination IP: 1.1.1.3 Destination translation: 192.168.3.3     NAT routing   /32 for public address used in destination NAT, /32 routes must be configured. For ONLY source NAT, these routes don’t have to be configured.   For server in public_dmz Destination: 3.3.3.10/32 Interface: Eth1/2 Next hop: None   For server in private_dmz Destination: 2.2.2.20/32 Interface: Eth1/3 Next hop: None   For the first server on LAN: Destination: 2.2.2.100/32 Interface: Eth1/4 Next hop: None   Security rules configuration   For server in public_dmz Source zone: Internet Destination zone: public_dmz Source IP: Any Destination IP: 3.3.3.10 Destination applications: web-browsing, ssl Action: Allow   For server in private_dmz Source zone: Internet Destination zone: private_dmz Source IP: Any Destination IP: 2.2.2.20 Destination applications: web-browsing, ssl Action: Allow   For the first server in LAN Source zone: Internet Destination zone: trust Source IP: Any Destination IP: 2.2.2.100 Destination applications: web-browsing, ssl Action: Allow   For the second server in LAN Source zone: Internet Destination zone: trust Source IP: Any Destination IP: 1.1.1.3 Destination applications: web-browsing, ssl Action: Allow   Global permit rules for zones:   Source zone: public_dmz Destination zone: Internet Source IP: 2.2.2.0/24 Destination IP: Any Destination applications: web-browsing, ssl Action: Allow   Source zone: private_dmz Destination zone: Internet Source IP: 10.10.10.0/24 Destination IP: Any Destination applications: web-browsing, ssl Action: Allow   Source zone: tust Destination zone: Internet Source IP: 172.16.0.0/16, 192.168.0.0/16 Destination IP: Any Destination applications: web-browsing, ssl Action: Allow ... View more

Hello!   I downloaded MT 3.1 for vmware player, imported it and turn it on. MT has ip adres 192.168.208.129 and I can ping it, but when I try to access it using HTTPS, it refuses connection.    Does anybody had similar problem and how it can be solved?   Best regards, Maja ... View more

Hi! Customer configured Palo firewall to work in Layer 2 mode to protect VLAN. In that VLAN there are two servers in MS NLB configuration. In VLAN configuration in Palo, static MAC entry is configured for virtual MAC address, but that entry isn't displayed with show mac command. See attached picture and listing: mkopcic@PA-4020> show mac Bridge_4-440 | match 02:bf:0a:0b:08:f8 mkopcic@PA-4020> Application (HTTP portal) works if real IP adresses are used, but if virtual IP adress is used, application is unreachable. Ping to virutal IP address is working. On Palo I captured dropped packets and saw that Palo is dropping traffic to NLB virtual address. See attached file. Does anyone have idea why Palo is dropping traffic? Best regards, Maja ... View more