topic Re: Trust interface on vm not coming up in AWS in VM-Series in the Public Cloud

Trust interface on vm not coming up in AWS

ASM_Research — Thu, 20 Jun 2019 18:58:38 GMT

Im doing some testing in AWS with a DEV server on the inside of my vm 100.. I have E1/2 configured as gateway interface with a ENI private IP address we created in AWS. However, after troubleshooting almost the entire day I cant get it to come up. Im using 9.0.1 so this could be a bug but Im not sure. Has anybody every encountered this?

Re: Trust interface on vm not coming up in AWS

hsong — Thu, 20 Jun 2019 19:45:41 GMT

The intercace not coming up: is that means no traffic flow? If it’s newly added to the VM, please make sure that disable source/ destination check of the ENI.

Re: Trust interface on vm not coming up in AWS

ASM_Research — Thu, 20 Jun 2019 21:50:17 GMT

I have a better understanding of the problem. In AWS , the way the IP addresses are allocated are very confusing to me. Ive read the PA documentation and I cant find anywhere were it explains how you are supposed to use the Eth0, Eth1, etc and how these map back to the Palo Alto vm's. I have to understand IP addressing in AWS land and I just cant get my head around it. If anybody has a knowledge based article that explains this please send. Also, the vm-series deployment guide IS NOT helpful for this. Yes, I read it

Re: Trust interface on vm not coming up in AWS

jmeurer — Thu, 20 Jun 2019 22:03:11 GMT

AWS ETH0 = PA Management

AWS ETH1 = PA ETH1/1

AWS ETH2 = PA ETH1/2

AWS ETH3 = PA ETH1/3

This assumes you did not perform an interface swap during deployment. If so Management and ETH1/1 would be reversed so that ETH1/1 is the target of an ELB.

Re: Trust interface on vm not coming up in AWS

ASM_Research — Fri, 21 Jun 2019 15:03:38 GMT

Thank you. unfortunately, that brings up more questions so I think I will stop here

Re: Trust interface on vm not coming up in AWS

ASM_Research — Fri, 21 Jun 2019 15:41:38 GMT

Can somebody tell me this - if Eth0 and E1/1 are showing different IP addresses in teh AWS instance window, than what I have configured, what course should I take. Currently, E1 is a private ENI and Im pretty sure that wont work as my public IP address.

Re: Trust interface on vm not coming up in AWS

jperry1 — Fri, 21 Jun 2019 15:59:18 GMT

I may have missed something but it sounds like you did the following

1. configured your interfaces in PAN-OS statically

2. Didn't set the AWS ipconfiguration to static

If that is the case go back into the VM-Series and change the interfaces to dynamic

For any of the dataplane interfaces only check "add default route" for your untrust interface

Re: Trust interface on vm not coming up in AWS

ASM_Research — Mon, 24 Jun 2019 15:03:45 GMT

Thanks for the help. The problem I have now is that even though E1/1 (untrust) is configured as DHCP client, Palo Alto shows N/A for the IP address. Under "dynamic IP int status" everything is all zeros.

Re: Trust interface on vm not coming up in AWS

ASM_Research — Mon, 24 Jun 2019 20:49:48 GMT

Went ahead and made it static. Seemed to work. Attribute this as a PANOS bug in 9.0.1