Routing question

Brad_Teige — Mon, 23 Jan 2023 23:54:13 GMT

I might be overlooking something fundamental.

We are trying to slow-step out of another firewall into a PA. I have created an interface on the PA in the old subnet. I can ping across to the server and old firewall.

Clients behind the PA cannot get a DHCP address. I am wondering if trying to maintain the same subnet on a Legacy VLAN will even work.

I am trying to put clients on the old subnet via layer 3 vlan. All the new switches have a static route that point to the PA interface (192.168.1.250). The PA VR has a static route to the old firewall (192.168.1.1). There is a DHCP relay pointed to the server (lets say 192.168.1.3 I have a rule in place to allow traffic back and forth including security and threat policies. I see no blocks and the old firewall has routes in place for return traffic.

Clients>Layer 2 VLAN on new switches>PA layer 3 interface>old flat network>old firewall(default gateway)

I have pings allowed, but my client on the new switches with layer 2 VLAN cannot get DHCP and cannot communicate with static IP addresses.

I will sleep on this and comb through all configurations in the morning, but was hoping for a sanity check on the overall idea.

Re: Routing question

aleksandar.astardzhiev — Wed, 25 Jan 2023 07:32:49 GMT

Hi @Brad_Teige,

One note you need to remember for PAN DHCP relay is that once FW receive the DHCP request and try to forward it to the DHCP server this traffic becomes inter-zone. Meaning the DHCP request from interface/zone pointing to the users needs to be forwarded to another interface/zone pointing to DHCP server. For that reason you need to have rule allowing dhcp traffic from one zone to another.

Step2 from this guide - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFXCA0

Above guide define any as destination, I would suggest you to restrict to only your trusted DHCP server.

I would also suggest to try to eliminate DHCP relay issues by:

- Set static IP address one of the problematic machines, try to ping PA FW interface in that network (if don't have interface zone protection ping will fail, but) important part here is to check if you have ARP entry on the laptop for FW IP. Check if you have ARP on FW interface for that laptop. If no ARP you probably have issues with the VLAN config .

- Set a packet capture on PA interface pointing to the users - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClTJCA0

Important for the filter is to set : inbound interface, and non-IP include. Leave the capture running and try ipconfig /renew to trigger new DHCP request (don't forget to switch back from static ip to dhcp if you are testing from same laptop)

topic Routing question in Next-Generation Firewall Discussions

Routing question

Re: Routing question