topic Re: Help me to fix this issues /possible solution in Next-Generation Firewall Discussions

Help me to fix this issues /possible solution

Zola12 — Mon, 22 Apr 2024 09:22:12 GMT

I am going to configure Palo alto 5250 firewall to branch Huawei router

The device is not physically connected , i try to do static route from Palo alto to Huawei router router but the network is not reachable.

kindly support me how to fix type of issues ,

Help me also kindly suggest me new solution for this type of network scenario

Re: Help me to fix this issues /possible solution

seb_rupik — Mon, 22 Apr 2024 13:08:57 GMT

Hi there,

You have one of two options, either source-NAT the traffic leaving the PA and Hauwei have a corresponding static-NAT at the destination and have it travel 'in the clear' across the telecom network. Or, create a Layer3 IPSec tunnel between the PA and Huawei and route directly between them.

Using the tunnel would be the preferred option as it will protect your traffic flows from snooping and interception. It will also allow you to configure a dynamic routing protocol between the two sites to share prefixes.

This option is the most scalable as the dynamic routing will handle increases in target IPs and not require additional static-NAT configuration.

Whichever solution you choose, you will need to configure a security policy on both the PA and Huawei to let the traffic flows into the sites.

cheers,

Seb.

Re: Help me to fix this issues /possible solution

Zola12 — Tue, 23 Apr 2024 06:10:23 GMT

What type of interface used to do source-NAT in the PA side , sub interface ? also in Huawei router side ? since not physical connection

Re: Help me to fix this issues /possible solution

seb_rupik — Wed, 24 Apr 2024 08:32:01 GMT

Hi there,

By its design source-NAT must be configured on a layer3 interface: physical, physical sub-interface, VLAN.

cheers,

Seb.

Re: Help me to fix this issues /possible solution

Zola12 — Thu, 25 Apr 2024 13:27:53 GMT

Dear Friend

Still not solved , ping from firewall to remote router is working but ping from remote router to firewall is not still working. Also i cant ping 8.8.8.8 from Palo alto maybe if the issue is linked with. I can't ping a Firewall interface side

Re: Help me to fix this issues /possible solution

jfernandez1 — Thu, 25 Apr 2024 13:33:23 GMT

Could you please check if the management profile is correctly applied on the interface you are trying to ping?

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/configure-interfaces/use-interface-management-profiles-to-restrict-access