demonlag

I ended up sick this week and am not going to make the show. I have two tickets (seated together). Free to a good home, all I ask is you please use them and don't resell them. Shoot me a DM and maybe include your favorite dinosaur.

Got a weird one, to me at least. FTD (or I guess "Secure Firewall") 3130 running 7.2.2.

Customer has a half dozen remote locations using policy route VPN from their local ASA back to the FTD, tunnel all style.

Customer has a VPN connection to Azure on the same FTD using a VTI interface with a /24 learned via BGP from the tunnel.

After migrating this config from ASA to FTD, the remote sites can no longer reach the Azure subnet. Sites inside of the FTD can reach Azure subnet. AnyConnect users can reach the Azure subnet.

Remote sites can reach inside the FTD. Remote sites can reach internet through the FTD. Remote sites can reach other remote sites through the FTD.

Packet capture

Hey everybody!

Got an interesting (to me) situation. Client wants to do pre-logon tunnels for all machines via certificates, then on-demand user tunnels for a limited set of users using SAML.

Everything is individually working. Portal configuration has a pre-logon agent pointing clients to prelogon.contoso.com, and an 'any' user pointing to vpn.contoso.com. Agents are set to pre-logon then on-demand. 'Pre-logon tunnel rename timeout' is set to '0', which documentation says should immediately terminate the pre-logon tunnel.

It isn't. A user logs in to the machine and the pre-logon tunnel remains up indefinitely. Tested settin

Got a quirky issue with OSPF adjacencies bouncing.

The general layout is a Catalyst 4500X at a core site that has (among other connections), three 10g links to three other locations, also with Cat 4500X switches, and a 1g link to a Cat 3750.

Initially presented as phones/meetings dropping during the day, troubleshooting found the core 4500X sitting at ~85% average CPU load and all OSPF links configured with 'ip ospf dead-interval minimal', resulting in 200ms hello/1s dead intervals. Logs showed every ~45-60 minutes during the day the core switch logging 'dead-timer expired' for these links. They'd come back up a few seconds later. Remote switches are virtually idle when it comes to

Hoping someone has seen an issue like this before because PAN support is not making entirely great suggestions to help troubleshoot.

We have a pair of 5220s in active/standby HA. We are currently running 10.1.5-h1. We have a mix of Globalprotect client versions (5.1, 5.2 and 6.0). This past weekend we upgraded the firewalls to 10.1.6-h3.

Post upgrade everything seemed fine until I got dropped from Globalprotect with a keep-alive timeout. I blamed Verizon and kept working until 16 minutes later I got dropped again. I popped into the monitor tab and looked and every Globalprotect connection was doing the same thing. Connect for 16 minutes, disconnect, reconnect. Client OS version di

Needed 128GB of RAM for a lab machine. Found a cheap 64 GB 2133mhz kit (4x16GB), wasn't suspiciously low priced, seller has a few thousand reviews and a 4.8 rating. Nope. Seller sent me 2 sticks of RAM total.

To Newegg's credit, the chat rep confirmed that "it's odd" that I only got 2 sticks in the mail and immediately created an RMA. I'm still out a week of time, a couple hundred bucks for a few weeks until the RMA and credit get processed.

My first order with Newegg in 18 months and probably my last for at least another 18 months. I'd rather buy open box/refurb from Ebay at this point as I feel more comfortable that I'm going to get what I bought there.

Sad.

Just had a few players bail out for an upcoming tournament in Wayne, NJ. Exhausted my friends list and current teams looking for replacements, Reddit you're my last hope.

General details:

Location: Ice Vault Arena, Wayne NJ

Date: September 4th and 5th
(We play Saturday at 3:45 PM and 5:30 PM, Sunday at 11:45 AM and maybe 5:00 PM depending on standings)

Skill level: C Level-ish.

Beer tent outside, bar inside. Not too serious of a tournament, just fun weekend of hockey, beer, and hanging out.

If interested please comment or chat for more information.

Got a nice email this morning at 8:30 AM that everything is super peachy, and now barely over an hour later and the console is down again.

Our security team is trying to integrate their QRADAR SIEM into our PAN 5520s running version 9.x via an External Dynamic List. Their MSP for the SIEM has it set to generate a text file at something like https://<qradar.appliance>/blocked_ips.txt to be used as an IP List EDL. The trouble they ran into is the firewall reports 'Operation Failed URL access error' when they test this source.

Pointing it at a test Linux box and doing a capture, I can see the firewall is attempting TLS 1.0 handshakes while none of our web servers are configured to permit TLS 1.0. Enabling TLS 1.0 in the test server results in a successful test. We submitted a case to PAN support including a PCAP showi

I RMA'd a failed H110i v2 back in the beginning of July. I provided a credit card number for cross shipping. I received the replacement and returned the failed unit. I put the tracking number in the ticket.

Since then, Corsair has switched to a new ticket system. My ticket transferred over, but no details. I asked for an update a week or two ago and heard nothing. I just posted another request for an update. My visa was charged $150 on July 11 and has not be credited since.

Is this typical RMA support from Corsair?