topic Re: Routing issue with Palo alto in General Topics

Routing issue with Palo alto

AzerTurkBank — Mon, 18 Oct 2021 17:59:18 GMT

Hello everyone!

I am experiencing an odd problem.

I have 3250 HA pairs. I have configured 2 aggregate(L3 trunk) interfaces and added sub interfaces to these aggregate.

The first problem is the firewall itself can not ping directly connected device by using "ping source x.x.x.x host y.y.y.y" command.

Every sub interface has management profile assigned.

The each aggregate interfaces has connected to 2 cisco stack switches.(switchstack1---aggregate1-aggregate2---switch-stack2)

I set IP addresses on both switches, however, there is not connection between two switches even though they have default route towards palo alto. I can not even ping from switch to palo alto interface.

Re: Routing issue with Palo alto

MP18 — Tue, 19 Oct 2021 01:45:34 GMT

@AzerTurkBank

Are you ping from Active PA?

Did this ever worked before?

Is both interfaces show up on PA and Cisco?

In MGMT Interface is Ping allowed ?

Which source IP you are using to ping Cisco Switch?

You need to use PA interface IP to ping the Cisco Switch directly connected interface.

Regards

Re: Routing issue with Palo alto

BPry — Tue, 19 Oct 2021 03:15:04 GMT

@AzerTurkBank,

That honestly sounds like you either don't have ping enabled on the interface-management-profile or you have permitted-ip setup on the profile and the IPs your attempting to ping aren't included.

Re: Routing issue with Palo alto

AzerTurkBank — Tue, 19 Oct 2021 05:50:05 GMT

Are you ping from Active PA?

To tell the truth, no. the first problem has fixed thanks to you.

Did this ever worked before?(this is new deployment)

Is both interfaces show up on PA and Cisco?(Yes)

In MGMT Interface is Ping allowed ? Yes- it is allowed.

it seems switch was L2 and there was routing issue. I changed the switch to router and it responded ping packets.

Re: Routing issue with Palo alto

AzerTurkBank — Tue, 19 Oct 2021 06:07:40 GMT

Hi,

IP addresses allowed in MGMT profile are 10.0.0.0/8. 172.16.0.0./12 and 192.168.0.0./16

Re: Routing issue with Palo alto

AzerTurkBank — Tue, 19 Oct 2021 06:11:52 GMT

Strangly,I realized that only 1 sub if is able to ping firewall. firewall has three sub interface under aggregate 2.

Aggregate 2.31, ae2.32 and ae2.33

I am able to ping from ae2.32 connected router to firewall, but can not ping from other 2 sub interfaces connected router to firewall.

Same MGMT profile is used for all interfaces and A, B,C class ip addresses included in this MGMT profile.

Meanwhile, both devices are visible in the ARP table.