Skip to content
NetworkTechGuy
Subscribe

Blog

  1. OpenConfig plugin on Palo Alto FWs - how to delete it

    #firewall #paloalto

    I ran into an interesting problem recently - one of the firewalls I manage had to be upgraded, but the problem immediately showed up when I tried doing an image upgrade: I went to Device -> Plugins and there was the perpetrator openconfig-2.0.0 plugin that was installed. I tried removing the config

    1 min read

  2. Configure Palo Alto Cloud Identity Engine to use Authentik as IdP

    #authentik #cie #cloud-identity-engine

    Cloud Identity Engine (CIE) is a cloud-based service designed to simplify identity and access management across different environments, including on-premises, cloud, and hybrid setups.

    7 min read

  3. Configure Aruba VSX on 8100 series

    #aruba #vsx

    Aruba VSX (Virtual Switching Extension) is a technology developed by Aruba, designed to enhance network resilience and performance by enabling the creation of a highly available, redundant, and scalable virtual switching environment. There are a few steps that need to be performed, as outlined:

    2 min read

  4. Palo Alto FW can't download software with proper licensing applied

    #firewall #paloalto #updates

    We recently had a situation where firewall was complaining that it can't download software anymore with an error message An active license is required for this feature. Firewall was properly licensed and it was synced with the license server, but for some reason, it was still complaining about it.

    1 min read

  5. Palo Alto FW IP-tagging

    #firewall #paloalto

    IP-tag functionality on Palo Alto Firewalls allows administrators to apply custom labels or tags to IP addresses or ranges. These tags serve various purposes, such as simplifying policy creation and management by grouping similar IP addresses together under a single tag. Additionally, IP-tagging ena

    6 min read

  6. Palo Alto SAML SSO with authentik

    #authentik #firewall #paloalto

    Palo Alto network appliances natively support SAML and can leverage providing identity to a SAML Identity Provider. This can be very useful in multiple ways - granting access to admin GUI interface, authenticating users for GlobalProtect (remote access VPN) and Captive Portal user authentication are

    12 min read

  7. How to configure Authentik IdP with docker compose

    #authentik #docker #docker-compose

    In this post we will do an initial setup of Authentik IdP (Identity Provider), an excellent piece of software that provides user identification. On top of being an IdP, it also allows us to use it for SSO purposes, which we will utilise to grant access to our users to internal resources. It can als

    5 min read

  8. Migrating Palo Alto Panorama from VMware/ESXi to Proxmox

    #esxi #paloalto #panorama

    I recently started moving all of my VMs to Proxmox, and even though I already had one PA firewall running under Proxmox, I was not very keen on tackling the task of migrating Panorama. I have two Panorama nodes running in HA in mgmt-only mode, and in addition to those, I also have two Panorama insta

    3 min read

  9. Palo Alto GP connection method 'On-demand' not working on some Windows clients

    #globalprotect #gp #paloalto

    I've noticed on some of the Windows (maybe this happens on macOS as well, but haven't tested it) that even though the App configurations setting for Connection Method was set to On-demand (Manual user initiated connection), it would still try to immediately connect to VPN when user logs into Windows

    1 min read

  10. Let'sEncrypt with Dynamic Updates to DNS - RFC2136

    #dns #letsencrypt #rfc2136

    I've been using Cloudflare for a while now and I'm quite happy with their free plan. However, one thing that I'm missing there is the fact that you can't create subdomains - at least I don't think there is one. Since I have a subscription to Azure, I would simply create new DNS zones there and point

    8 min read

  11. How to configure PA FW as NTP proxy

    #firewall #ntp #paloalto

    There is a nice functionality on PA firewalls called DNS Proxy. It basically allows PA FW to act as an DNS proxy for hosts that will use its interface address for DNS queries. The way it works is that you configure it in the GUI by configuring primary and secondary servers and then you point your ho

    4 min read

  12. Palo Alto FW loopback interface routing

    #firewall #loopback #paloalto

    Recently I started deploying loopbacks on all of my network devices that are somehow participating in routing and I hit a momentary roadblock when I realised that none of my loopbacks configured on firewalls are being advertised via iBGP. The reason for that is because all loopback interfaces are c

    1 min read