topic NGFW routing internet traffic help in Next-Generation Firewall Discussions

NGFW routing internet traffic help

ebryan — Wed, 27 Oct 2021 01:22:40 GMT

I am setting up a very simple PA200 implementation and all I need at this stage is to be able to contact the Palo update server to update the PanOS. I have the FW plugged in directly from ethernet1/1 to the modem (subnet 192.168.0.1). The gateway is pingable. My machine is connected to the the management interface (172.16.30.35). I have virtual router configured to send all traffic (0.0.0.0/0) out of ethernet1/1. I have an any/any security policy set. I have a NAT rule (I suspect this is the problem) configured to translate the networks to each other (at least that's my intention). I know the issue is something simple but I can't get past it. Any help would be appreciated.

Re: NGFW routing internet traffic help

BPry — Fri, 02 Jul 2021 03:09:49 GMT

@ebryan,

Is your intention to make the PA-200 sit at the edge of your home network? Assuming that this is the case, your NAT statement as presently configured doesn't really make much sense unless you have a route on your modem/router (assuming you aren't talking about an actual straight modem) combo unit pointing back to your firewall. Otherwise you wouldn't have a return route pointing the traffic back to your firewall.

Generally for a home setup your NAT statement would simply have your source-translation setup like so:

Translation Type: Dynamic IP And Port

Address Type: Interface Address

Interface: ethernet1/1

IP address: None (Assuming DHCP assignment, otherwise you can select the static address from the drop down)

What this will do is simply NAT all of the traffic through the address assigned to your ethernet1/1 address and out through the modem. This then allows your modem to know where it has to return the traffic without any additional route configuration.

Re: NGFW routing internet traffic help

Mick_Ball — Fri, 02 Jul 2021 07:35:28 GMT

also... have you really put your external interface into the trust zone? if not then perhaps the NAT destination should be "untrust"

Re: NGFW routing internet traffic help

ebryan — Fri, 02 Jul 2021 10:36:59 GMT

Thanks for your help. I have updated the NAT statement as such. I'm still not getting internet connectivity, though. What other information do you need for us to continue troubleshooting?

@Mick_Ball

Thanks for pointing that out. I have made that correction as well.

Re: NGFW routing internet traffic help

SureshReddyM — Fri, 02 Jul 2021 14:35:57 GMT

Hi,

can you share me route table output.

you can use below steps to get it.

>network > virtual Routers><vr-name> >more runtime stats

And also try to test ( internet, security policy, ping etc) from below step.

device > Troubleshooting >

Best Regards,

Suresh

Re: NGFW routing internet traffic help

Mick_Ball — Fri, 02 Jul 2021 15:45:59 GMT

This is my NAT.

If still not working then try changing the service route for updates to ethernet1/1... if that works then perhaps an issue before it hits the NAT policy...

Re: NGFW routing internet traffic help

LAYER_8 — Fri, 02 Jul 2021 19:13:07 GMT

If NAT and MGT addresses are correctly populated and ruled out, could it be more basic?

Are you able to verify that you've given the MGT server a reachable DNS server?

Re: NGFW routing internet traffic help

ebryan — Fri, 02 Jul 2021 22:09:02 GMT

Hi. Here is the route table. 192.168.0.43 is the DHCP address of the FW.

My device is at PanOS 8.1.6 so it doesn't have the troubleshooting tools mentioned above.

Re: NGFW routing internet traffic help

ebryan — Fri, 02 Jul 2021 22:25:36 GMT

No, MGT cannot reach a DNS server. I have manually set it to 8.8.8.8 and 9.9.9.9. DNS is pingable from ethernet1/1 but not from MGT

Re: NGFW routing internet traffic help

Mick_Ball — Sat, 03 Jul 2021 07:49:50 GMT

Is the trusted interface on the firewall 172.16.30.1/24 and is it also a member of the same virtual router as ethernet1/1.

Re: NGFW routing internet traffic help

Mick_Ball — Sat, 03 Jul 2021 08:06:44 GMT

Hang on a mo..... you said at the first post... “My machine is connected to the the management interface (172.16.30.35)”. If this is the case then how is the management interface going to see the palo trusted interface? Or perhaps i have misread....

Re: NGFW routing internet traffic help

ebryan — Sat, 03 Jul 2021 15:01:05 GMT

@Mick_Ball Thanks again for your help. Yes, 172.16.30.1/24 is on the trusted interface of the firewall and a member of the same virtual router.

I believe that's my problem; the management interface cannot see the trusted interface.

Re: NGFW routing internet traffic help

Remo — Sat, 03 Jul 2021 16:25:19 GMT

@ebryan

So currently probably the firewall or at least the default-vr has internet access but not your management interface as this one is conected to your computer. The route table of the management plane is completely separated from other dataplane configurations (all the actual firewallinterfaces). In a default configuration the firewall tries to reach everything from the management interface which means the firewalls tries to download updates for example over your computer. I see now two possiblities

You connect the firewalls managementinterface to eth1/2. This should enable internet access for the firewall but in your current configuration you then don't have a connection to the firewall.
You configure serviceroutes on the firewall. Under Device > Setup > Services > Service Features > Service Route Configuration you can specify another interface than the managementport as source for specific services like dns, paloalto updates. When you change this the firewall should be able to reach the dns servers and download the updates

In your situation I propose to use possibility 2 and change the sourceinterface for the services that require internet access. If you do this, then a firewallpolicy is required to allow that traffic but as you already have an any-any-allow rule this shouldn't be a problem.

Re: NGFW routing internet traffic help

Mick_Ball — Sat, 03 Jul 2021 17:05:46 GMT

@Remo has your best solution here... but if you have a spare switch/hub then just connect ethernet1/2, management interface.. and your laptop into it... Boom!

Re: NGFW routing internet traffic help

ebryan — Sat, 03 Jul 2021 18:03:28 GMT

Thanks for your help. I've added loopback.1 (192.168.0.1/32) to the desired service route but I'm still unable to access the updates server. I tried the other method as well without success.

Re: NGFW routing internet traffic help

Remo — Sat, 03 Jul 2021 18:47:44 GMT

Ok, then ...

What zone did you assign to loopback.1?
Did you ad the loopback interface to the same virtual router as ethernet1/1 (your "external" interface)?
Did you check the trafficlogs for connections from 192.168.0.1 towards the configured dns servers on port 53?
Did you commit the configuration prior to checking for new updates?

Re: NGFW routing internet traffic help

Remo — Sat, 03 Jul 2021 19:43:02 GMT

... or configure the interface eth1/2 as layer2 and also another port to the same layer 2 vlan and there is no need for a switch/hub 😉😉

Re: NGFW routing internet traffic help

ebryan — Sat, 03 Jul 2021 19:46:15 GMT

loopback.1 is in the untrust zone

The loopback and interface 1/1 are both on the same virtual router

I can see log entries from 192.168.0.1 to the configured DNS servers

Yes, I committed the changes prior to testing

Re: NGFW routing internet traffic help

Remo — Sat, 03 Jul 2021 19:50:59 GMT

In these sessions in the trafficlog, is NAT applied there?

Re: NGFW routing internet traffic help

ebryan — Sat, 03 Jul 2021 19:54:30 GMT

Yes. This is the NAT policy: