About rchung54

@RamprakashRT    Thanks for your reply. I have lately been testing with Thinfinity RDP gateway and that works very well. I am curious about SAML on Guacamole so will configure and test that too at some point. ... View more

@BruceBennett  @MickBall    Our mail is hosted by a company for the UK public health service. When on the LAN, we connect to the Exchange servers with a private IP range, via our public health ISP/WAN provider.. When off LAN, ie. in a public airport lounge, we can still connect to the same Exchange servers for our mail, via public IPs. Don't know the full set up of the Exchange servers, as this is managed externally, but that's what I've figured out.   I expected MS Outlook just to work, once I was logged in via GlobalProtect, as effectively, I was on the corporate LAN. Mapping to shared drives etc all worked fine along with everything else. Just seemed bizarre MS Outlook didn't.   How I eventually got MS Outlook to work via GlobalProtect, was I had to create a static route with the private IP range and point it back into my inside LAN facing interface (my Trust zone). All been fine since.   ... View more

Thanks Steve,   It would be a nice feature to have. ... View more

Hi Bruce,   Perhaps getting Wireshark on to see how the packets flow and start from there. Using Wireshark helped me to see which IP MS Outlook was connecting to, then I needed to get the IP (and subnet) confirmed by the company hosting our Exchange servers. It sounds like using MS O365 is more complicated, but good luck.   Robert ... View more

@SteveCantwell    Hi Steve, managed to solve the issue myself. I needed the IPs for the specific mail servers we connect to. Once they were confirmed, I put in a static route for the IPs and Outlook now works.   Thanks for your tips on this.   Robert ... View more

Hi Steve,   Thanks for your reply. I created a security policy to allow the traffic, but Outlook is still not connecting. Logs show bytes being sent, but none are being received. Was hoping the security policy would resolve this. Have logged a TAC case for advice. ... View more

@jeremy.larsen    Hi Jeremy, do you mean a switch between Internal Router A (and B) and Firewall 1 (and 2) and use VRRP or HSRP? ... View more

@ jeremy.larsen   So, I've been labbing this up and have created the floating static routes on all the routers as you mentioned. In steps 12 and 13 of the configuration guide, it says redistribute the floating static routes upstream and downstream. Does this mean I have to create a Redistribution Profile on the Palo Alto and add it to the Export Rules in OSPF?     Many thanks in advance. ... View more

Hi Jeremy,   Thank you for your reply. Why the floating static routes are used, does make sense, in case OSPF does fail, the traffic will still flow.   So I would configure a static route on Edge Routers A and B (the upstream routers), pointing to the Datacentre LAN. And a static route pointing to the Internet/0.0.0.0/0, on Internal Routers A and B (the downstream routers). Is this correct for this scenario?   An Active/Active option is not possible as the Palo's will be 25 miles apart from each other (for DR purposes). The two Palos will be connected via the HA link over 2 x L2 links between two sites. One of these L2 links will be the primary (the active) and the other will be the secondary (the backup link), hence exploring the Active/Passive design option.   Please let me know if I am right about the configs of the static routes, on those routers. ... View more

Hi pulukas, rmfalconer, Otakar.Klier,   Thank you for your responses and advice.   @OtakarKlier- Both the Palo's can ping each other if I source the IPs, even when I don't have static rule set up   I lab'd this up again following the Site-to-Site VPN with Static and Dynamic Routing config guide in the PAN-OS 8.1 Admin guide and got the tunnels up with the remote sites pinging each other.     However, it did take a bit of tweaking with trial and errors, until I got the config working.  The config steps are not clear in the Admin guide, if one is new to Palo Alto and VPNs.   These are the observations I made when I lab'd this up again.   1. On the IKE Gateway configuration, the Admin. guide said use the FQDN for the local and peer identification. This did not work for me in my lab.   Instead, I used the following config on both Palo's, by specifying the Peer IP address and the local and the IP peer addresses for the Local and Peer identification:     2. I was told that static routes pointing down tunnels should not have a next hop address defined. If it did not, how would the secure traffic travel across the tunnel? in order for my config to work, i had to specify the Next Hop IP address of the tunnel interface.     3. Both my Palo Alto's do not see each other as OSPF neighbours. Surely they would only see each other as OSPF neighbours, if both Palo's had OSPF running on them? Not sure why the guide stated this, only one of the Palo's has OSPF configured. The peer VM-PA-02 which has OSPF configured. has formed a neighbour relationship with router R1 fine.   Anyone else had to tweak things to their configs working?   Many thanks.   ... View more

@pulukas   Hi pulkas,   I have created this profile (underlined in red), is this what you mean?       ... View more