About ldavie

I have not been able to find an answer to this in the searching I have done. Does ECMP take into account the current load on the paths before choosing a path? We are using 'balanced round robin' on our metro-e links between locations, we have two providers with identical bandwidth at each location. My question is this: lets say a backup session starts from location A to B, and it is placed on path "2", and that session uses 80% of the bandwidth. Path "1" is only at 10% utilization, and the next session is placed on path "1" because of round robin. Now the 3rd session starts and is placed on path "2" again, and let say that utilization is now at 99% on path 2 and path one is at 20%. Will path 2 continue to take every other session or does the algorithm realize that path "1" is underutilized and favor that path? ... View more

Hello. Currently we use OSPF as our routing protocol between five locations over a layer two IP Ethernet network provided by telco A. In order to get carrier diverse routes and add redundancy we are adding a second similar network provided by Telco B. We have a single “normal” (not stub or NSSA) OSPF area with a metric of 10 and a single redistribution profile. Each location and a PAN HA pair of firewalls.   If we want to use this new circuit as a backup I believe I just need to create a new area ID specifying the interface of the new circuit and give it a higher metric? OR use the same area and add the new interface with a higher metric? I am thinking the second. If we then want to force specific traffic down the new circuit then we would use PBF rules forwarding to the new interface.   Is it a bad idea to use the same metric and let it load balance? What is the best practice for this situation?   Thanks for you input. ... View more

Hello all. Tomorrow night I will be upgrading our firewalls to 6.1.7, they (and Panorama) are currenlty on 6.0.7. Can I upgrade Panorama now and still manage the firewalls on 6.0.7 if I need to make any changes between today and tomorrow?   Thanks! ... View more

We have a fairly large group of thin clients that auto logon to a user account that is used for launching their Citrix desktop. We are also using the PAN firewall to use NTLM (browser-challenge) for captive portal for internet access for all users. What this means is that we have over a 1000 machines that all have an ip to user mapping to the same user and this means that all web browsing on these machines are under the auto logon user. What I am trying to figure out is how do I get the firewall to prompt with a web-form captive portal for all of these auto logon machines so that we can capture the actual user at these machines. This would be easy if all of these machines were is the same network but they are mixed in with other users too. If I could write a rule that said “if you are the auto logon account then prompt for a web form” that would do it but I cannot figure out how to do that. What option might I have here? If I remove the auto logon account from being in the allowed internet access group then the firewall will do an ntlm challenge to the browser and then just be given the auto logon account again, so I don’t think that would work. I would think that it needs to be a web-form. ... View more