topic Re: ESXI Server - Inside Host is on Same Port Group as Palo Alto FW Inside Interface and Pings are failing from all inside hosts in VM-Series in the Public Cloud

ESXI Server - Inside Host is on Same Port Group as Palo Alto FW Inside Interface and Pings are failing from all inside hosts

ETate — Mon, 18 Oct 2021 18:09:01 GMT

I have a ESXI Server with firewall (Inside, DMZ and Outside) zones

Palo Alto has a rule to allow interzone traffice from inside to outside

Palo Alto has NAT configured for Outside Interface

When I try to ping from host to host on in the same port group...all is good.

When I try to ping to the Inside Firewall Interface, the ping times out..."Destination Unreachable.

Host---->Vnic------->Port Group-------->Vswitch....

Re: ESXI Server - Inside Host is on Same Port Group as Palo Alto FW Inside Interface and Pings are failing from all inside hosts

SutareMayur — Wed, 20 Oct 2021 08:01:28 GMT

Hi @ETate So as per my understanding, you are trying to ping inside (or Data Plane) interface of the firewall. I would recommend you to check few things given below-

1. Check if Interface MGMT profile is configured on the interface which actually allows required services like ping on it.

2. Check routing to reach host from the firewall. If interface IP is configured using /32 subnet mask, you would need to define specific routes for the host to reach.

3. Verify the traffic logs on the firewalls to see what's happening on the firewall.