topic Re: On PA VM unable to change service route configuration to select another interface for example e in VM-Series in the Public Cloud

On PA VM unable to change service route configuration to select another interface for example eth1

fatboy1607 — Thu, 22 Aug 2019 17:10:17 GMT

On PA VM unable to change service route configuration to select another interface for example eth1

VM 8.1.6-H2

Re: On PA VM unable to change service route configuration to select another interface for example e

jmeurer — Thu, 22 Aug 2019 17:17:06 GMT

You need to assign a static IP address to the Interface before it can be used as a service route. Just ensure you use the same IP as what is assigned by the cloud provider.

Re: On PA VM unable to change service route configuration to select another interface for example e

fatboy1607 — Thu, 22 Aug 2019 17:30:12 GMT

Problem is I cannot change it to static as it needs to stop VM to do that ? would it be possibel to change it to static without rebooting VM ?

Secondly I dont understand why my firewall is using public ip to communicate with DC even though I have private ip assigned on management interface

Re: On PA VM unable to change service route configuration to select another interface for example e

jmeurer — Fri, 23 Aug 2019 17:06:32 GMT

You do not need to reboot to assign a static in the Firewall GUI, you leave the assignment as is on the EC2 side. You just need to assign that IP in the firewall GUI as a static. I cannot guarantee that it will not be traffic impacting though as it works through the DHCP release during the commit.

As for your second question, that comes down to how your VPC routing is configured. Traffic leaves the Firewall Mgmt interface on its private IP, if VPC routing sends the traffic to an IGW or NatGW, the fabric will then SNAT to the assigned EIP. If you have a route pointing to on prem via a DX or VGW, then the traffic should remain private.