About bdunbar

Did you get some suitable NAT sorted out with the PA SE? We did: kudos to Wes for being awesome. ... View more

Interesting.  Those documents are now out-of-date. Last night I was on the phone with Wes, our Palo Alto SE (hi, Wes) and we did this .. eth4 IP 10.1.0.1/16 209.59.29.193/26 Applied this IP to a host IP 10.1.1.40 Subnet: 255.255.0.0 Gateway: 10.1.0.1 And it worked. ... View more

For what it is worth, I have attached the to-be physical and logical diagrams.  ... View more

I need to update my diagrams to reflect changes that were inflicted last night - I'll do that and update.  Not the very least because I need to update. I did also create a support case last night (there was talk around the cage that the problem was a defective unit, and more talk that we should just nuke the firewall and reinstall from scratch, and I really, really, wanted to not do that).  The support tech, Ceaser, ID'd the problem, in a nutshell, and my words, 'you are trying to route a non-routable network'. He sent notes, and suggested we get in touch with our SE (I didn't know we had one of those!) but, in a nutshell, the fix is to take my three layer 2 interfaces and make them layer 3. "Non-routable networks don't route".  Seems so obvious after-the-fact. ... View more

Interesting: I tried to delete the reference to 209.59.29.193/26 from eth4 and was told .. Validation Error: deviceconfig -> system -> route -> destination -> 209.59.29.221 -> source -> address '209.59.29.193/26' is not a valid reference deviceconfig -> system -> route -> destination -> 209.59.29.221 -> source -> address is invalid config commit phase 1 aborted(Module: routed) Config commit phase 1 aborted(Module: device) panike_daemon phase 1 aborted(Module: ikemgr) config commit phase 1 aborted(Module: dhcpd) config commit phase 1 aborted(Module: varrcvr) modhttpd phase 1 aborted(Module: l3svc) Now .. 209.59.29.221 is one of two active directory servers I have.  And of course, I have UserId talking to them.  Ideas? ... View more

FWIW here is my routing table before, and after .. admin@tn-gateway-01> show routing route flags: A:active, ?:loose, C:connect, H:host, S:static, ~:internal, R:rip, O:ospf, B:bgp,        Oi:ospf intra-area, Oo:ospf inter-area, O1:ospf ext-type-1, O2:ospf ext-type-2 VIRTUAL ROUTER: default (id 1)   ========== destination                                 nexthop                                 metric flags      age   interface          next-AS 0.0.0.0/0                                   209.59.31.137                           10     A S              vlan.10 10.50.1.1/32                                10.50.1.1                               10     A S              tunnel.10 10.50.1.2/31                                10.50.1.2                               10     A S              tunnel.10 10.50.1.4/30                                10.50.1.4                               10     A S              tunnel.10 10.50.1.8/29                                10.50.1.8                               10     A S              tunnel.10 10.50.1.16/30                               10.50.1.16                              10     A S              tunnel.10 10.50.1.20/32                               10.50.1.20                              10     A S              tunnel.10 209.59.29.192/26                            209.59.29.193                           0      A C              ethernet1/4 209.59.29.193/32                            0.0.0.0                                 0      A H 209.59.31.136/29                            209.59.31.140                           0      A C              vlan.10 209.59.31.140/32                            0.0.0.0                                 0      A H dmin@tn-gateway-01> show routing route flags: A:active, ?:loose, C:connect, H:host, S:static, ~:internal, R:rip, O:ospf, B:bgp,        Oi:ospf intra-area, Oo:ospf inter-area, O1:ospf ext-type-1, O2:ospf ext-type-2 VIRTUAL ROUTER: default (id 1)   ========== destination                                 nexthop                                 metric flags      age   interface          next-AS 0.0.0.0/0                                   209.59.31.137                           10     A S              vlan.10 10.1.0.0/16                                 10.1.0.0                                0      A C              ethernet1/4 10.1.0.0/32                                 0.0.0.0                                 0      A H 10.50.1.1/32                                10.50.1.1                               10     A S              tunnel.10 10.50.1.2/31                                10.50.1.2                               10     A S              tunnel.10 10.50.1.4/30                                10.50.1.4                               10     A S              tunnel.10 10.50.1.8/29                                10.50.1.8                               10     A S              tunnel.10 10.50.1.16/30                               10.50.1.16                              10     A S              tunnel.10 10.50.1.20/32                               10.50.1.20                              10     A S              tunnel.10 209.59.29.192/26                            209.59.29.193                           0      A C              ethernet1/4 209.59.29.193/32                            0.0.0.0                                 0      A H 209.59.31.136/29                            209.59.31.140                           0      A C              vlan.10 209.59.31.140/32                            0.0.0.0                                 0      A H total routes shown: 13 ... View more

It does not appear to be mentioned in either my few security or NAT policy. ... View more

Too late for Friday, but helpful when we want to expose it on the network: thanks. ... View more

Duh on me: I failed to include the port address.  Thanks. ... View more

Seems like a great opportunity to learn the API, thanks. Created the user, assigned the role.  the link https://my.ip.add.res/api/?type=keygen&user=obfuscate&password=obfuscate  returns a 404. "Access Error: 404 -- Not Found Can't locate document: /api/" APi isn't turned on? ... View more

Thanks! We're not quite ready to use Panorama, but if we keep buying PAN we will. ... View more