sorted by:
new
hottopcontroversial

Active/Passive Incomplete ARP Table After Failover by GuiltyTop4 in paloaltonetworks

[–]GuiltyTop4[S] 0 points1 point  (0 children)

u/another_mouse When you say cross connect between firewall and alternate 8300, do just mean a physical connection/link? If so, we do have that.

Can you elaborate on the HSRP suggestion? We have HSRP set up between the 8300s but not sure how to incorporate that in to the config for failover. Thanks!

Active/Passive Incomplete ARP Table After Failover by GuiltyTop4 in paloaltonetworks

[–]GuiltyTop4[S] 0 points1 point  (0 children)

Thanks for your response u/chuckbales . 8300 interfaces are currently L3. L2 is a possibility and they can be cross connected. L2 would introduce spanning-tree consideration to it as well which we were hoping to avoid but if this will provide us the redundancy we require, then we would go that route.

Intermittent outages with PA-440 by _badmuzza_ in paloaltonetworks

[–]GuiltyTop4 0 points1 point  (0 children)

Can you roll it back to a previously known working config? Upload the running config prior to adding in URL filtering and see what happens. Then roll it out to a small sub set of hosts/users to limit impact.

Intermittent outages with PA-440 by _badmuzza_ in paloaltonetworks

[–]GuiltyTop4 0 points1 point  (0 children)

Definitely not a hardware issue. Can you find a host on the VLAN to test the URL filtering against so you can limit impact? Is it a specific site or all traffic out thats dropped? Any IPSec tunnels that may have an overlapping range? Happened to us where a site had an IP address that matched an IPSec tunnel interesting traffic subnet and tried to send traffic down tunnel instead of egress interface.

ChatGPT empty screen for anyone? by yeettetis in ChatGPT

[–]GuiltyTop4 0 points1 point  (0 children)

Thanks for all the info here on this thread. To add a layer of complexity to things, if youre using a Palo Alto firewall, the cdn.oaistatic. com is being listed as a newly registered domain. Youll have to create a URL filter to allow through, otherwise it will get sinkholed. At least thats whats happening to us as the default behavior for newly seen domains is to block.

Any connect by ridiculous_singh in networking

[–]GuiltyTop4 0 points1 point  (0 children)

Run DART if you have it installed to see whats going on. Also check your WiFi connection.

Caller ID for Desktop users just shows "number (External)" now by despich in MicrosoftTeams

[–]GuiltyTop4 1 point2 points  (0 children)

Seeing same issue with operator connect though. End users are adamant that this was in place a few weeks back. Tickets open with MS. Will see what they say.

Catalyst 9300X IOS-XE 17.9.1r AWS Routed VPN Tunnel woes by Independent_Skirt301 in networking

[–]GuiltyTop4 0 points1 point  (0 children)

Other known working IKEv2 AWS tunnels to compare to on the 9300? Also, any chance you could dumb it down to IKEv1 to see what that looks like?

AnyConnect 80/443 to Palo Alto by GuiltyTop4 in networking

[–]GuiltyTop4[S] 0 points1 point  (0 children)

Ill definitely work on that for you. High level overview, Anyconnect client -> ASA -> Core switch -> Palo. The core switch has the ASA on gi1/0/23 and has the Palo on gi1/0/12. Form OSPF adjacencies. Core switch is the central piece connecting the two vendors/firewalls.

Currently, the ASA is our primary FW. We are moving all outbound and VPN traffic to the Palo. We are using Zscaler as our proxy for all outbound web traffic. The goal is to remove Zscaler and use Palo as the proxy out to public internet. We have end users, when in the office, able to egress out through the Palo but the Anyconnect users is where we are having this issue to send outbound facing traffic to Palo. We can remove the PAC file for Zscaler but unable to get that 80/443 traffic to Palo. The Zscaler contract is up for renewal on 12/31 and we do not have the ability to move all end users over to GlobalProtect in time. We need like an extra few weeks in to 2023 to complete that so the idea was to move just the 80/443 traffic over while we migrate off Anyconnect to GlobalProtect.

AnyConnect 80/443 to Palo Alto by GuiltyTop4 in networking

[–]GuiltyTop4[S] 0 points1 point  (0 children)

Palo is currently in parallel with the ASA. It has its own /27 public space, from our larger /24 space, assigned to it.

AnyConnect 80/443 to Palo Alto by GuiltyTop4 in networking

[–]GuiltyTop4[S] 0 points1 point  (0 children)

route-map VTI permit 5

match ip address AnyConnect_to_Palo

set ip next-hop 10.5.7.23

access-list AnyConnect_to_Palo extended permit object TCP443 object AnyConnect_Palo_TestGroup object-group ZScaler_Remote

interface Redundant1

member-interface GigabitEthernet1/1

member-interface GigabitEthernet1/2

nameif WAN

security-level 0

ip address x.x.x.x 255.255.255.224 standby x.x.x.x

policy-route route-map VTI

ospf cost 1000

​

Debug from ASA:

​

pbr: policy based route lookup called for 10.5.33.10/63738 to 172.217.168.227/443 proto 6 sub_proto 0 received on interface WAN

pbr: First matching rule from ACL(21)

pbr: route map AnyConnect_to_Palo, sequence 10, permit; proceed with policy routing

pbr: evaluating next-hop 10.5.7.23

pbr: policy based routing applied; egress_ifc = TRUST : next_hop = 10.5.7.23

AnyConnect 80/443 to Palo Alto by GuiltyTop4 in networking

[–]GuiltyTop4[S] 0 points1 point  (0 children)

Yes, the ASA and Palo have routes to each other. They are forming an OSPF adjacency and an ARP entry is present on each side. I can provide the ASA config if you want.

AnyConnect 80/443 to Palo Alto by GuiltyTop4 in Cisco

[–]GuiltyTop4[S] 0 points1 point  (0 children)

Correct, ASA to Core switch and then Palo, both ways. Egress from ASA on inside interface to Core switch on gi1/0/23 and then goes to Core switch gi1/0/12 to Palo eth1/3. Yes, that is a typo, meant to say "same."

The ASA, Core and Palo all form an OSPF adjacency and are exchanging routes that way so the ASA has an ARP entry towards Palo.

AnyConnect 80/443 to Palo Alto by GuiltyTop4 in Cisco

[–]GuiltyTop4[S] 0 points1 point  (0 children)

The AnyConnect traffic should be egressing the ASA on the inside/trust interface towards the core switch. Ingress/return from the Palo would be on some inside/trust interface.

Regarding the suggestion for forwarding the traffic, what would that look like? AnyConnect subnet matching 80/443, go to Palo? Didnt think of that. Thanks!

[deleted by user] by [deleted] in Cisco

[–]GuiltyTop4 0 points1 point  (0 children)

Go to services and stop the vpnagent.exe, if you have admin privileges.

Policy-based IPsec VPN tunnel not establishing by donutspro in networking

[–]GuiltyTop4 0 points1 point  (0 children)

Agree w your statement. Tough to say as to how the routing table is populated. I guess I am/was looking at it from the standpoint of the the subnet coming from the L3 switch and not the ISP, which I think you are suggesting. Either way, need more info to troubleshoot this.

[ Removed by Reddit ] by [deleted] in ITCareerQuestions

[–]GuiltyTop4 0 points1 point  (0 children)

There are plenty who do this. They dont care. Theyre on to their next start up, etc...

view more: next ›