I ran into an interesting problem recently - one of the firewalls I manage had to be upgraded, but the problem immediately showed up when I tried doing an image upgrade: I went to Device -> Plugins and there was the perpetrator openconfig-2.0.0 plugin that was installed. I tried removing the config
Cloud Identity Engine (CIE) is a cloud-based service designed to simplify identity and access management across different environments, including on-premises, cloud, and hybrid setups.
Aruba VSX (Virtual Switching Extension) is a technology developed by Aruba, designed to enhance network resilience and performance by enabling the creation of a highly available, redundant, and scalable virtual switching environment. There are a few steps that need to be performed, as outlined:
We recently had a situation where firewall was complaining that it can't download software anymore with an error message An active license is required for this feature. Firewall was properly licensed and it was synced with the license server, but for some reason, it was still complaining about it.
IP-tag functionality on Palo Alto Firewalls allows administrators to apply custom labels or tags to IP addresses or ranges. These tags serve various purposes, such as simplifying policy creation and management by grouping similar IP addresses together under a single tag. Additionally, IP-tagging ena
Palo Alto network appliances natively support SAML and can leverage providing identity to a SAML Identity Provider. This can be very useful in multiple ways - granting access to admin GUI interface, authenticating users for GlobalProtect (remote access VPN) and Captive Portal user authentication are
In this post we will do an initial setup of Authentik IdP (Identity Provider), an excellent piece of software that provides user identification. On top of being an IdP, it also allows us to use it for SSO purposes, which we will utilise to grant access to our users to internal resources. It can als
I recently started moving all of my VMs to Proxmox, and even though I already had one PA firewall running under Proxmox, I was not very keen on tackling the task of migrating Panorama. I have two Panorama nodes running in HA in mgmt-only mode, and in addition to those, I also have two Panorama insta
I've noticed on some of the Windows (maybe this happens on macOS as well, but haven't tested it) that even though the App configurations setting for Connection Method was set to On-demand (Manual user initiated connection), it would still try to immediately connect to VPN when user logs into Windows
I've been using Cloudflare for a while now and I'm quite happy with their free plan. However, one thing that I'm missing there is the fact that you can't create subdomains - at least I don't think there is one. Since I have a subscription to Azure, I would simply create new DNS zones there and point
There is a nice functionality on PA firewalls called DNS Proxy. It basically allows PA FW to act as an DNS proxy for hosts that will use its interface address for DNS queries. The way it works is that you configure it in the GUI by configuring primary and secondary servers and then you point your ho
Recently I started deploying loopbacks on all of my network devices that are somehow participating in routing and I hit a momentary roadblock when I realised that none of my loopbacks configured on firewalls are being advertised via iBGP. The reason for that is because all loopback interfaces are c
