topic AWS VM-series - untrust interface - eating packets in VM-Series in the Public Cloud

AWS VM-series - untrust interface - eating packets

abhishah03 — Tue, 20 Jul 2021 06:32:40 GMT

Hi Guys,

I am working on inbound (from the internet) flow on the VM-series untrust interface directly.

Set up -

VM-series FW - 3 interface -- Mgmt , Untrust , Trust

Client -> Internet GW -> EIP -> Firewall untrust interface - eth1/1 - > (SNAT - eth1/2 ; DNAT - Server private IP ) -> Server

In the monitor log, I can see the SNAT & DNAT taking place, traffic being allowed by Security rule.

But nothing is getting forwarded to the Server ... No packets are received on the server-side.

I have checked routes ,

default - 0.0.0.0/0 -- exit thru untrust -> IGW

private subnet - 10.x.x.x/24 -- thru Trust interface

Is this not bound to work with directly attaching EIP to untrust interface ?? The same set-up works fine , with an NLB (network load balancer) in front of VM-series fw (untrust interface)

Just to note - Already have opened TAC support case , with no luck -- too much of back and forth of info sharing , with zero constructive suggestions 😞

++ @jmeurer -- Any suggestions??

Re: AWS VM-series - untrust interface - eating packets

tostern — Tue, 20 Jul 2021 06:43:12 GMT

Hi @abhishah03,

sorry to hear that had no luck with our TAC team.

Your problem that you subscribes could have many reasons.

- Did you checked your Security Groups on all interfaces?

- Did you reviewed all route tables that the traffic get's forwarded correctly?

- Did you already asked AWS TAC if they can see the packets and could they explain you the reason why the packets didn't received the client host?

Regards,

Torsten

Re: AWS VM-series - untrust interface - eating packets

abhishah03 — Tue, 20 Jul 2021 07:01:53 GMT

@tostern -- Please find the answer inline -

- Did you checked your Security Groups on all interfaces? -- SG is set, properly -- Hence the packets are reaching the PA firewall & logs reflecting the same on (AWS flow logs, PA monitor logs)

- Did you reviewed all route tables that the traffic get's forwarded correctly? -- Routes is straight forward --- 2 routes on virtual router --

default - 0.0.0.0/0 -- exit thru untrust -> IGW

private subnet - 10.x.x.x/24 -- thru Trust interface -- 10.0.0.1

- Did you already asked AWS TAC if they can see the packets and could they explain to you the reason why the packets didn't receive the client host? -- Reason needs to be explained from PA I believe, the packets are reaching the firewall, but not exiting from there :(.

Re: AWS VM-series - untrust interface - eating packets

tostern — Tue, 20 Jul 2021 07:13:51 GMT

@abhishah03

so you can see that the packet is leaving the PAN FW but you didn't get any return traffic?

Did you checked the AWS route tables and are you sure you haven't any SG on the Server that can block the traffic?

Regards,

Torsten

Re: AWS VM-series - untrust interface - eating packets

abhishah03 — Tue, 20 Jul 2021 07:15:55 GMT

Nope , I can see the packet only entering PA FW ...

Re: AWS VM-series - untrust interface - eating packets

tostern — Tue, 20 Jul 2021 07:17:44 GMT

@abhishah03 please send me a email tostern@paloaltonetworks.com then i want to have a deeper look into it.

Afterwards we can share here the solution of the problem.

Regards,

Torsten

Re: AWS VM-series - untrust interface - eating packets

abhishah03 — Tue, 20 Jul 2021 08:32:20 GMT

I've just sent you email, with all the details. Pls check & suggest.

The interesting part is everything works fine with traffic ingress point changed to AWS NLB; rather than utilizing the EIP of untrust NIC.

Re: AWS VM-series - untrust interface - eating packets

jmeurer — Tue, 20 Jul 2021 15:52:35 GMT

Make sure your SNAT rule is set with the original packet set to the untrust private IP and not the EIP. AWS SNATs on the way in and firewall sees the packet after the EIP translation. Also, ensure both interfaces are added to the VR.

Re: AWS VM-series - untrust interface - eating packets

abhishah03 — Tue, 20 Jul 2021 18:34:21 GMT

Yup , that's already in place.

Using Private (untrust) IP in NAT; also both interfaces are added in VR.

Re: AWS VM-series - untrust interface - eating packets

Connected123 — Fri, 13 Aug 2021 02:15:05 GMT

@abhishah03 what was the solution to your problem? Pls advise the steps so we can also benefit from it.