About pkonitz

more and more clients ask about it and what can I say ... Team please consider it as feature request and you will see how many clients sign up this. regards ... View more

Sorry for refreshing this thread but There was such an option for PA 4.x What is more - in 5.0.10 there is still some kind of information about this functionality show global-protect-gateway gateway name GW1 GlobalProtect Gateway: GW1 (0 users) Tunnel Type          : remote user tunnel Tunnel Name          : GW1-N         Tunnel ID                 : 1         Tunnel Interface          : tunnel.51         Encap Interface           : loopback.51         Inheritance From          :         Local Address             : 194.0.220.51         SSL Server Port           : 443         IPSec Encap               : yes         Tunnel Negotiation        : ssl         HTTP Redirect             : no         UDP Port                  : 4501         Max Users                 : 0         IP Pool Ranges            : 10.140.1.2 - 10.140.1.254;         IP Pool index             : 0         Next IP                   : 0.0.0.0         DNS Servers               : 10.128.1.240                                   : 10.128.2.240         WINS Servers              : 0.0.0.0                                   : 0.0.0.0         DNS Suffix                :         Access Routes             : 0.0.0.0/0;         VSYS                      : vsys1 (id 1)         SSL Server Cert           : Portal51         Auth Profile              : SZP_LDAP         Client Cert Profile       :         Lifetime                  : 86400 seconds         Idle Timeout              : 86400 seconds So my question for now is: - is this a limitation of the new version of GlobalProtect client? - is this functionality again on the roadmap? its quite useful regards Przemek ... View more

hi all, I'd like to continue this thread cause I've got some doubts as well 1) In the doc "QoS in PAN-OS 4.1" they mention: 3) Configure QoS on the interface b) The sum of the “Egress Max” bandwidth on clear text tab and tunnel traffic tab should be less or equal to the interfaces egress max bandwidth. It doesn't make sense for me cause if there is no tunnel traffic I want my clear traffic to use the max available bandwidth of the int, however it makes sense for me that the sum of Guaranteed Egress (10 + 10) should be less or equal the max egrees of the int. 2) considering these settings Qos-profile (G: 2Mbps, Max: 2Mbps) class 1 (G: 1Mbps, Max: 2Mbps) - priority high class 2 (G: 1Mbps, Max: 2Mbps) - priority medium class 3 (G: 0 - so unlimited?, Max: 2Mbps) priority realtime if there is a congestion and both traffic of class1, class2 and 3 hits the PA accordingly class3 - 1,5Mbps class2 - 1Mbps class1 - 1Mbps what will the result be? I guess that class3 and 1 would not prevent the class2 from flowing but the share for this one would be minimum? 3) Default QoS profile and its classes 6,7,8 have low priority. If there is a congestion and traffic hits all of the classes will it be shared equeally? 4) in situation when traffic enteres PA form source int 1/1 and 1/2.110 but uses the same egress int 1/10 considering that both QoS profiles has the same parameters for class 2 (the same priority) and there is only class 2 traffic (from both src int) should the bandwidth be shared equally when using egress int 1/10? regards Przemek ... View more

We opened the case and they did replicate the problem so I'm avaiting the result the problem is that this locally logged users should access the Internet but with the rights of Administrator Policy on PALO so either Terminal Agent or User Agent need to do the mapping of this user. Meanwhile: - terminal agent ignores console 0 - doesn't see the mapping - user id agent does the mapping but whenever normal terminal user logs in, AD seems to create similar logs and user id agent overwrites this mapping regards Przemek ... View more

hi, thx for update nice to hear it worked. I decided to go to L2 deployment cause in Wwire mode passive unit doesn't pass traffic at all so in my case (cisco ASA) hello packets  did not flow so failover on ASA was a bit problematic. However L2 with vlan retagging works as charm, what is more, when ASAs switchover it does't trigger PAN to failover so I see additional benefit in it As NGS said active/active probably would solve all our issues but this is thing I want to avaid cause guys from PaloAlto suggested not going into A/A regards ... View more

great - it worked after modifications so this is not true what the book says  Note that you do not specify the virtual wire object during the creation of the subinteface. Since the subinterface is built on an existing virtual wire interface, the virtual wire object is inherited from parent interface. However, the subinterface and parent interface can be configured on different zones ... The subinterfaces allow you to separate and classify traffic into different zones by either VLAN tags or VLAN tags in conjunction with IP classifiers (address, range, or subnet.) ... the main interface must be on separate vwire object and each one of the subinterfaces as well. No vlan tagging on Vwire !!! only on subinterfaces only then subinterfaces are seen as being on separeted zones thx Seweryn hope to be in touch regards Przemek ... View more

Hi Seweryn, What do u mean by not configuring a Vlan/vwire on subinterfaces? As it is written in coursebook subinterfaces inherits vlan/vwire config from main interface. I can set it on the main interface but after that there is no choice for subinterface to have the same vwire assigment (casue this vwire was already used) from the book: Note that you do not specify the virtual wire object during the creation of the subinteface. Since the subinterface is built on an existing virtual wire interface, the virtual wire object is inherited from parent interface. However, the subinterface and parent interface can be configured on different zones I have vwire crated (its called LAN) have ethernet 1/1 assigned to LAN. then have no option for subinterface. But i think this in not the problem. The main issue is that even though I've got different security zones assigned to subinterfaces the traffic flows only when main interfaces is assigned to it as well. As a consequence subinterfaces inherits it from main interface (the proof is in logs) so I cant diferentiate traffic based on ZONES. regards Message was edited by: Przemyslaw Konitz ... View more

As I described in this post https://live.paloaltonetworks.com/thread/7403 I've got this release installed, got subinterfaces configured and assigned them to different zones but traffic doesn't flow if the main intarface isn't assigned to zone as well. When it is, subinterfaces inherits this assignment form main interface and even though they're in different one I see in logs that traffic comes from the main zone. So I cant make a different policies per subinterfaces. Thanks for sharing your experience I think we should end this topic cause gmparis will be angry for all the notification he receives regards Przemek ... View more

We had issues with managing secondary ASA after failover. Hence could not check the status on secondary ASA. After a while, the Active PAN was primary. I suspect that is due to the reason that the destination ip was reachable via Standby ASA (when Active). Yes I have preemptive option enabled. That is a good option to check for. I think this was your issue - I mean PREEMPTIVE option. As I remember ASA in active/standby mode doesn't behave in a preemptive manner (it can but as I remember only in multicontext mode). So after a while passive PAN regain its connectivity with path monitoring through currently active ASA so it switches again. What is your case? I've just tried this "Passive Device Link State Control" and I changed it  to "auto" as picture presented earlier. However this  does not mean that ASA hearbeats can keep going !!! Its true that link is green but thats all. So no connectivity to the secondary ASA will be allowed when  the PAN box is passive. This make sense in order to avoid the situation when we could evade the active box and its inspection, but it is pain in the a... when sth behind it needs to send its heartbeats regards ... View more

This is my first experience with PAN so sorry for silly questions I see the interfaces Down on passive generaly becasue they are not connected to standby ASA (I don't have 2nd one in my lab ) However I've just seen there is an option for default bahaviour. I didn't get the thing about support. "L3 interface must be on the same subnet as dst address?" According to docs (at least for 5.0) it can be done. You also wrote: I however had issues later when Active PAN become Primary again What kind of issues? Did you enable Preemptive option? I think It should be disabled in this scenario as PAN need to follow ASAs. For now I think I will need to redesign everything and make PAN in L3 mode cause I even have problems with creating vwire subinterfaces and putting them in deferent zones. https://live.paloaltonetworks.com/thread/7403 Sorry for changing the subject. Do you have similar environment? regards ... View more

thx vwaghmar for your answer. as I remember you can't ping outside interface of ASA from inside   so don't bother. Maybe if you change "management-interface" for outside (which is not recomended) but it is not easily done casue managemnt-interface can't be the one with the lowest "security-level". Unfortunately I dont have 2 ASAs in my lab to test all interesting parts. My first question is whether PAN tranfers traffic in vwire when it is in passive mode? It is fundamental question cause If the answer is yes then it is no use of creating L3 interface for path monitoring cause its default gateway (L3 switch or inside interface of ASA) is always available regardless which ASA is acitve or standby. When ASAs do switchover the secondary one starts using the IP address of the previous primary one (which is default gateway for internal networks and L3 interface of PAN). OK I've found the info that traffic handling links on the passive device are in "down" state. Of course it wouldn't make sanse the other way but I had to ask As I said I can't test it in a full environment but I have to do it in production GREAT is it not? What about your case you've mentioned earlier? is it closed with the solution presented? or still have hope for some trick? idea? regards Przemek ... View more

Hi all I'll join this thread cause this is exactly what I'm looking for. I need to monitor HSRP address of routers because If outside interface goes down on cisco ASA, ASAs will switchover and PANs not. Do I realy need to create seperate L3 interface just for this purpose? If yes I think that it will be easier to create L3 interfaces on PAN. regards Przemek ... View more