About jeremylo

Hello BPry, I've used Paessler SNMP Tester to run a MIB walk. By examining through naked eye, I can't find any value related to throughput, just like what you've said it seems that not exist in the MIB. About "  ifInOctets" and "ifOutOctets". It seems that their corresponding OID are "1.3.6.1.2.1.2.2.1.10.x" and "1.3.6.1.2.1.2.2.1.16.x". However, my target interfaces have this value "0" in the walk result list. I'm surprised by someone who manage to did that through Cacti. Please take a look at https://live.paloaltonetworks.com/t5/automation-api-discussions/cacti-templates/td-p/7457?tstart=0 I've checked the downloadable xml files that are provided by the author. As expected, it relies on OID too, but sadly, I still can't find the correct one. ... View more

Hello Joerg, This is a solution too. However, I also want to keep track of which computer in Spoke1 have connected to Spoke2. ... View more

Bingo! I use those OID in http://www.oidview.com/mibs/25461/PAN-COMMON-MIB.html before. Change to OID = .1, and Mask = 0x80 works ... View more

Ping was enabled. ... View more

Just update this topic as I receive email said it already accept as solution but this is not the truth. I'll onsite to investigate the affected area later. ... View more

hello LukeBullimore, If I set the 2nd data line to higher priority. Will the same problem happen on the 1st data line? In my current settings, user subnet can use the 2nd data line to reach internet. Only the interface cannot. I want to use this interface for send alert email and get PAN-OS update. 1st data line has no service route need. But I still hope it can be ping. ... View more

well done Jezza, perhaps you could mark this as resolved and then log a new post for your new issue.   please include VR details and default gateways as this will help with diagnostics.... ... View more

Thanks for the reply Bpry, we do have threat prevention and app-id on, and had to move any dbase users to the same vlan cause of the slowdowns, so with the pa820 it should resolve that, I actually went and did the import export already to the pa820, and will change the cables at the end of the day to test. ... View more

Reason found. The vSRX was faulty. Setup and use the new version vSRX has no problem ... View more

The 2960 though will be fine with Etherchannel for LACP.     You could use the 2960 on both sides of the PA with seperate VLANS for internal and external traffic (but it's not ideal).   Rob ... View more

@JoeAndreini wrote: You could segregate traffic within the same subnet using L2 or vwire interfaces and inspect the traffic using intra-zone rules. Hello JoeAndreini, This seems impractical. I'll have huge workload to assign each computer to has its own L2 interface. ... View more

Thanks MickBall. Customize service route configuration solve the probem. ... View more

@jeremylo, Are you decrypting this traffic at all or not? If you look at the traffic logs is the UWP traffic actually getting identified as Skype traffic or is the firewall identifying the traffic as 'ssl'?  ... View more

Thanks reaper. 1 x NAT policy + 1 x Security policy did the trick ... View more