topic Re: Elastic IP's not responding on Palo Alto VM in VM-Series in the Public Cloud

Elastic IP's not responding on Palo Alto VM

Gregman380 — Wed, 08 Nov 2017 14:34:05 GMT

Greetings All,

I have a very basic question and basic issue. I have Palo Alto up and running in my lab on AWS. I can connect to the Management Interface just fine. I have added eth1 to the the PA and configured the access for ping, ssh, https, etc. Also created the zone. I am using the default virtual router.

From within my VPC using another Linux instance I can ping the private IP address on eth1, but I cannot ping the elastic IP address that is associated with that eni from the internet. I can ping the Management public address but not anything I add to eth1, eth2, etc. I am just out of ideas!!

Any help would be really appreciated!

Greg

Re: Elastic IP's not responding on Palo Alto VM

Warby — Wed, 08 Nov 2017 18:39:21 GMT

Hi Greg,

This should work and is supported. I've done this myself with no issues. Here are some things to try:

double check your AWS security group for that ENI
double check your subnet route
- if this ENI is on a different subnet then the management ENI, does that other subnet have an IGW route?
SSH in and run the command: show counter global filter delta yes
- then launch your ping to the EIP and repeat the command above
- look for any drops
as a last resort, override your default inter and intra security policy rules and turn on start/stop logging
- watch the traffic log

HTH,

Warby

Re: Elastic IP's not responding on Palo Alto VM

Gregman380 — Wed, 08 Nov 2017 19:04:56 GMT

Thank you for the feedback. Yes the ping is being denied according to the intrazone rule. I have a management rule that allows ping set up and applied to that interface. It should accept ping...

Thank you again!

Re: Elastic IP's not responding on Palo Alto VM

Gregman380 — Wed, 08 Nov 2017 19:16:01 GMT

Ok, well based on what you told me I think I may have been blocking myself!! It is working now and I thank you for your response. I learned some good troubleshooting along the way!!

Best Regards,

Greg

Re: Elastic IP's not responding on Palo Alto VM

p.manojkumar — Tue, 26 Apr 2022 17:51:33 GMT

Hi Warby,

I have this similar issue with Paloalto external interface elastic ip not reachable from internet

but mgmt EIP is reachable

Verified security group allow all traffic & enabled https

Any idea?

Thanks

Manoj

Re: Elastic IP's not responding on Palo Alto VM

Aashish1 — Fri, 12 Aug 2022 11:22:23 GMT

Hi Manoj ,

Please check the security group assigned to the public interface . Make sure all the traffic from 0.0.0.0/0 is allowed on all ports initalially while testing.