EmZaid 🫥

a gentle menace. they/she/it 🏳️‍⚧️
I want to know how stuff (ok everything) works
network engineer
GSEC, GCIH, GCIA
D&D/TTRPGS; Cats; many other things
theology as a kink

Pronouns: they/she
Blog: https://emzaid.gay/

Last Notes

2026-10-26 20:23:00 UTC

- reply

perfect. I don't have a good sense of what is normal fw stuff since this current place is the only place I've done this work 🙃

2026-10-26 20:17:07 UTC

- reply

I don't manage them which makes me happy given their recent spat of cves lol

2026-10-26 18:27:28 UTC

- reply

let's say we have 30ish routing instances that may or may not need to be extended to 30ish remote sites. currently that is done via mpls. (or one gre tunnel per instances...)
I'm proposing doing a split tunnel at the remote side, an ipsec tunnel back to central, and doing pbf on the same vsys where the ipsec tunnels land. it would require one pbf rule per routing instance we want to extend (and each instance gets its own /16 to keep the rules simple). the goal is that new remote site deployments only require one ipsec tunnel, one bgp peer, and then layer3 interfaces for any routing instances required. I want this dead simple for folks to deploy.

2026-10-26 18:18:22 UTC

- reply

the mtu issue is/was related to the juniper srx (mpls CE) being weird with mtu. we have tried a bunch of things (and are about to attempt mss clamping). We had some success with changing the srx mode but the details allude me right now.
The assumption I'm making is that ipsec (and by extension a palo on both ends) will handle mtu discovery better than gre.
I'm glad to hear that pbf can be a solid choice

2026-10-26 17:57:25 UTC

ok networking folks. how scared should I be of using policy based forwarding? palo seems to be discouraging it heavily (in favor of prisma), but I'm under the assumption that if I scope it right (large IP blocks with simple pbf policies) pbf shouldn't be thattt bad?
Palo seemed to imply pbf shouldn't be used for any greenfield deployment?
(for context I'm building a custom sd-wan solution to replace mpls over gre due to unsolved mtu issues lol)