About vcappuccio

 http://www.rfc-base.org/rfc-7413.html  however I fail to see the importance of allowing SYN with data or not.    2. Data in SYN Standard TCP already allows data to be carried in SYN packets ([RFC793], Section 3.4) but forbids the receiver from delivering it to the application until the 3WHS is completed. This is because TCP's initial handshake serves to capture old or duplicate SYNs. ... View more

Hi,   can you provide the show vpn ike-sa detail gateway <NAME>   https://live.paloaltonetworks.com/t5/Featured-Articles/Getting-Started-VPN/ta-p/68931 https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Troubleshoot-VPN-Connectivity-Issues/ta-p/59187   it sounds to me that your will need to configure your Dymanic VPN Local/Remote Identifier between your VPN peers in order to identify the VPN Devices.     Thx Victor   ... View more

Hi, I have not tested this, but probably something like this https://live.paloaltonetworks.com/docs/DOC-5986 with HULK Feb 10, 2014 7:37 AM (in response to mwhite@wavex.co.uk) suggestion ? thanks Victor ... View more

Hi Bollnas, perhaps this links would help? What is the Default Timeout Value for URL Override and Continue page? thanks Victor ... View more

Hi Girvin, Is just another Vlan from our point of view. the link you provide mentions:    Such a mechanism allows end devices to share the same IP subnet while    being Layer 2 isolated, which in turn allows network designers to    employ larger subnets and so reduce the address management overhead.    Connecting the firewall on (2)  L3 interfaces, assuming  that the private promiscuous port does not accept trunking. the firewall could route between those 2 subnet and performing your security operations.  If the other device supports trunking of primary vlan over the trunk port, then our device just need to have that interface as l2 with appropriate vlan tag and route on L3 Assigned to Vlans. In other words, the isolated and/or community vlans are just mapping of the primary Vlan and on the uplink port to the Firewall will be set to promiscuous mode, with the primary VLAN mapped to the secondary VLAN. Thank you Victor ... View more

Hello amappersona,  those  3 flaps you observe seems to be as expected, this is a counter that you can set (Jul 20 12:23:05 Warning: ha_event_log(src/ha_event.c:47), from the logs it looks that the other device is the one not reaching 172.16.0.10, is there any other alternate path to reach this network via l2? I am curios to understand why pinging this IP, it looks like monitoring the Ethernet port will be a better option, based on the diagram you provide, I am assuming that those bridge devices are not stp aware are they, why there is not link between them?  I would be interested in seeing the complete ha_agent.log off the other unit (better both sides ) just for grins, and if the issue is related to the flap, maybe setting the Passive Link State to Auto ( Device > High Availability then Edit Active/Passive Settings) could solve this issue? just my 2 bits, thanks Victor ... View more

Just in case, I hope this helps someone The Facilities and Severities of the messages are numerically coded with decimal values. Some of the operating system daemons and processes have been assigned Facility values. Processes and daemons that have not been explicitly assigned a Facility may use any of the "local use" facilities or they may use the "user-level" Facility. Therefore, for the facility levels: 16 local use 0 (local0) 17 local use 1 (local1) 18 local use 2 (local2) 19 local use 3 (local3) 20 local use 4 (local4) 21 local use 5 (local5) 22 local use 6 (local6) 23 local use 7 (local7) Similarly the numerical values for the severity levels is : 0 Emergency: system is unusable 1 Alert: action must be taken immediately 2 Critical: critical conditions 3 Error: error conditions 4 Warning: warning conditions 5 Notice: normal but significant condition 6 Informational: informational messages 7 Debug: debug-level messages The Priority value (the first component of a syslog message) is calculated by first multiplying the Facility number by 8 and then adding the numerical value of the Severity. For example, a kernel message (Facility=0) with a Severity of Emergency (Severity=0) would have a Priority value of 0. Also, a "local use 4" message (Facility=20) with a Severity of Notice (Severity=5) would have a Priority value of 165. In the PRI part of a Syslog message, these values would be placed between the angle brackets as <0> and <165> respectively. ... View more

Hi Tac.in Network > Virtual Routers > Select your VRouter > BGP, here is a working configuration i have on my lab - we can set BGP attributes for the route we are going to advertise be aware that the route you want to advertise, must exist in the RT. hope this helps Victor. ... View more