This post will go through configuring a Palo Alto firewall HA pair using LACP and enabling HA Passive State to speed up failover.  

I was looking into the fail over process on Palo Alto firewalls when configured in and active/standby configuration and having ports in LACP mode and was testing some failover procedures and found that without enabling specific LACP fail over settings there was noticeable packet loss while LACP negotiated on the standby PA. 

Recently I managed to pick up a PA-220 second hand for my lab and while i know it's old, it's still a great little firewall. I've got it up and running and it works well. Yes commiting changes can be quite slow, but for what i'm using it for that's not a big deal. I may try and get a Lab license if I can but really, it's just for me to play around with so will have to see how that actually goes. 

If you've read my recent posts, you'll know that I have a PA-220 firewall in my home lab now and have setup wired and wireless 802.1x authentication in my home network using Cisco ISE. I've now decided that I'd like to make use of the PA User-ID feature in my home network to allow only authenticated users access to specific resources on the network. To do this, I'm going to use the Cisco ISE Radius Accounting logs to send the user information to the firewall and create rules based on username instead of source IP.

I've been playing around with some BGP configuration lately and have come across advertise maps before but never really looked into them. A BGP advertise map is basically a way of telling the router, if this route exists or does not exist, then advertise these routes. 

Recently I've been tasked with replacing some old switch stacks at work with some new shiny Catalyst 9500 switches and started looking into how to Stack these switches as they no longer support stacking modules which at first seemed odd to me given that the backplane for Stackwise was like 160Gbps for the Cataylst 3600/3800 series switches from memory but it seems Cisco have decided to move to a Virtual Stackwise feature which uses the SFP/SFP+/QSFP ports on the switch instead of the dedicated Stacking Ports at the back.

I recently upgraded my phone to the new Samsung Galaxy S24 Ultra and have spent the last 24 hours setting it up only to find that when I tried to connect to my Wireless network using my certificates, it wasn't working. It failed on the SSL Handshake and wouldn't accept the Cisco ISE Servers certificate as trusted. 

In an earlier post I discuss MAB authentication for devices that don't support other 802.1x methods for authentication and authorisation to your network. In this post, I'm going to run through how to configure basic device profiling in cisco ISE that can be used in conjunction with MAB in order to make device authentication and provisioning simpler. 

To continue on with my theme of late, I'm going to go through time based conditions and how to apply them in ISE for your 802.1x authentication and authorisation. 

I've been doing quite a lot of 802.1x posts lately and that's mainly because I'm currently in the middle of deploying it in my home network. So to continue on with some more 802.1x, I'm going to run through MAB policies in this post.

In my previous Blog posts i've talked about wired and wireless 802.1x authentication. In this post, i'm going to run through adding a dACL to that configuration.