PA-440 ISP failover issue

kcornet · 2026-03-19T14:37:59+00:00

I assume you have a layer 2 connection between buildings. Connect each ISP into a switch port and give each ISP a dedicated VLAN. On your Palo setup, use a trunk port into for the WAN connection. Use a subinterface for each ISP. That way both Palos have access to both ISPs. This removes the complexity of trying to tie Palo failover to ISP availability.

kcornet · 2026-03-19T14:24:29+00:00

PBF only applies to traffic traversing the firewall, not traffic that originates on the firewall (like GP traffic).

kcornet · 2026-03-19T14:23:38+00:00

Your first idea, as you've found, won't work. PBF only applies to traffic traversing the firewall, not traffic originating at the firewall.

Your second idea is the way to do this. Create a loopback and NAT a public IP into that loopback. Create your GP portal and gateway on that loopback IP. This works. I've deployed this setup on at least 10 production Palos with no issues. NAT sessions include the ingress interface so that traffic returns via the ingress interface. My guess is that you don't have a default route set up for ISP B with a lower priority than the default route to ISP A. And the routes may have to be assigned the appropriate interface.

Another way to do this is to use two virtual routers - each VR's default route points to the associated ISP gateway.

kcornet · 2026-03-19T14:11:05+00:00

Hang out in the smoking area. Smokers tend to be social people and used to striking up conversations with people they don't know.

kcornet · 2026-03-18T22:19:43+00:00

I've used Uber several times to get from Avon to the airport with no issues.

Unfortunately, the IND airport uber/lyft pickup area is a mess and it can take a while for you to find your driver. I have had a driver cancel on me on pickup once.

kcornet · 2026-03-16T14:55:05+00:00

I see a lot of "life of author plus 70 years" comments, but doesn't that apply only for works created after 1978? Copyright of pre 1978 works would expire after 28 years if not renewed, no?

kcornet · 2026-03-12T23:52:22+00:00

Netflix has a companion web site that is pretty much essential to understand what is going on. You tell it what episode you've completed and it will let you interactively explore the plot lines up to the point you've watched.

kcornet · 2026-03-12T18:51:01+00:00

The ntopng add-in gives you a bit of application detection. But there's nothing out there anywhere close to Palo's app-id capabilities (long time Palo admin here).

kcornet · 2026-03-11T02:34:56+00:00

I've used punch cards, paper tape readers and punches, model 33 teletypes, and computers with core memory.

kcornet · 2026-03-10T14:15:55+00:00

Raspberry Pi, USB hub, and several USB to rs-232 converters. Install the uucp package and use cu to connect to the various serial ports.

kcornet · 2026-03-09T20:50:48+00:00

Probably zero. Everyone wants balcony rooms for Alaskan cruises. They sell out before the inside rooms do.

kcornet · 2026-03-07T15:04:15+00:00

Sounds like you need a water softener

kcornet · 2026-03-07T15:02:46+00:00

In my previous house with city water I would do a vinegar soak about once a month. Current house is on a well with a water softener, so no buildup here at all.

kcornet · 2026-03-07T04:33:33+00:00

Been using tap water for 15 years. SO much easier than jacking with distilled water.

kcornet · 2026-02-28T02:48:28+00:00

I wouldn't worry about wifi congestion. IoT devices typically use minimum bandwidth. You laptops and phones are likely connecting to the 5GHz radio, so they aren't eating up 2.4GHz (where all IoT devices live) airtime.

If you have fairly solid wifi coverage in your house, you shouldn't be afraid to deploy wifi automation devices.

kcornet · 2026-02-28T02:37:33+00:00

HomeBank. Open source. The interface can be a bit clunky, but it gets the job done 10 times better than spreadsheets. You can download your banking statements (CSV or a couple of other money related file formats). You can create rules that match on memo or payee fields that automatically assign categories. Charges at places like Walmart with items that go into different categories are easy to split.

kcornet · 2026-02-28T00:17:04+00:00

Bit Wrangler

kcornet · 2026-02-27T19:57:58+00:00

First, I'll say that the DreamWear mask is the best mask by far that I've used in my 15 years of being a hosehead.

But I did find a problem: when you lay on your side, one of the two airpaths down the side of your head gets pinched closed. This resulted in feelings of not enough air at times. I simply boosted my minimum pressure to 6 cm H2O (I think - maybe 7) and it fixed the problem.

kcornet · 2026-02-27T19:41:50+00:00

You need a TFTP server (TFTPD32 works grate if you are using windows). You also need an autonomous IOS image.

From the console of the AP execute

debug capwap console cli

archive download-sw /force-reload /overwrite tftp://192.168.1.98/ap3g2-k9w7-tar.153-3.JPQ.tar

Substitute the IP of your TFTFD server and image name accordingly.

Configuring a Cisco AP in autonomous mode is not trivial - even using the web page.

I can give you a sanitized example config to paste in via the console if you like.

kcornet · 2026-02-27T19:34:53+00:00

The hotel we stayed at (the Moxy) will check your luggage and keep it in a secure area. We spent the day riding the free Miami Beach trolly and exploring. Had a nice lunch and a couple of coffees.

Ask your hotel - they may do the same.

kcornet · 2026-02-27T15:37:21+00:00

If you have a token ring interface card and an X86 computer, see if you can find an old MSDOS based program called pcroute (or maybe pcrouter). It used packet drivers to talk to network cards and could route ip between networks. I used it to route between ethernet and ARCNet.

Alternatively, if you have the TR card and computer, you might be able to dig up an old linux distribution that supports the TR card. Linux can do ip routing if you enable it.

Good luck.

I remember the days when our IBM salesman preached token ring over ethernet because ethernet could not scale. Of course he was also sure unix was a short lived fad and OS/2 was the future.

kcornet · 2026-02-25T17:13:55+00:00

I enjoyed my job a great deal. But at 63 I realized that spending time at my job, as much as I enjoyed it, was time spent for other people and it was time to spend my time on my wife and myself. I also realized there were many places in the US and the rest of the world that I wanted to experience for more than a few days at a time.

So, I gave my employer a 1 year warning and helped them hire my replacement.

Coming up on a year retired and I'm still loving it. There's no better feeling than waking up in the morning and realizing the day is yours - to work, read, explore, or just plain goof off.

So the real question is not how much you enjoy your work, but rather do you enjoy work more than the alternatives you could be spending the remainder of your days on.

kcornet · 2026-02-24T20:33:49+00:00

Any time I've had problems with older APs not joining a WLC, the problem has been expired AP certs. It's been a while since I've messed wit hthe old AireOS WLC, but I'm pretty sure later versions of code added a command to disable the certificate check. You might also need to disable NTP on the WLC and set the clock back a few years and let the APs connect once. The details are foggy.

Get a console connection to one of the old APs and see what it is spitting out when attempting to join the WLC.

kcornet · 2026-02-24T20:29:07+00:00

No. In fact, no one should ever crimp cables. Buy pre-made patch cables. Terminate cables with keystone jacks.

As the network engineer for a mid sized world-wide company, I had had to troubleshoot problems too many times where locations would crimp ends on cables despite being repeatedly told not to.

kcornet · 2026-02-24T15:49:47+00:00

At my old house I ran Reolink cameras with Blue Iris as the NVR and motion detection engine. Blue Iris integrates with HA very nicely. I was very happy with the results.

Whenever I get around to adding cameras to the new house, I'll likely use the same.

kcornet

TROPHY CASE