Tag: Palo Alto
-
Are These Actually the Same Rules? A CheckPoint-to-Palo-Alto Migration Audit
Two firewalls that both call something “the address at 10.4.x.x” are not saying the same thing, if one of them stores that address as an object called dns-primary and the other stores it as a signed 32-bit integer with no name attached at all. Before anyone can ask whether a migration preserved the rulebase, both…
-
A Hit Counter Doesn’t Know When It Started Counting
A rule that has matched nothing in nine minutes and a rule that has matched nothing in eighty days look exactly the same in the output. I wrote about that moment on LinkedIn; this post goes deeper into the toolchain around that observation: three small Perl tools written to consolidate a set of independently managed…
-
When the Fix Becomes the Failure: ECMP, Zone Protection, and a 64KB Ceiling
Three ECMP firewall cutovers went cleanly. The fourth did not — and the cause turned out to be Palo Alto MSS clamping, hidden inside a zone protection profile that had passed through three clean rollouts undetected. It was the highest profile pair in the sequence, sitting at the data center boundary. The Setup The Baylor…