No ICMP hitting Palo Interface but ICMP is allowed

BrianFyre — Wed, 06 Apr 2022 21:55:02 GMT

I have a greenfield Palo with a fresh ISP.

Have confirmed from the Palo I can source from my interface and ping outbound to anywhere in the world.

Interface mgmt has been set to allow ICMP, I've left the allowed IP's blank and also set my specific IP, neither allow ICMP traffic to the interface.

The more frustrating thing is that nothing is hitting the interface at all so I can't get to GlobalProtect for VPN and this is holding up the cutover from legacy ASA's

Anyone have any thoughts other than call the ISP and upgrade firmware. Firmware is 10.2.0 now, ISP has been contacted and they say no issues. There is a /30 from the ISP and then a routed /28 over it. I'm using the /30 for GlobalProtect, this is the IP that can ping outbound. Nothing has been tested from the routed /28

Re: No ICMP hitting Palo Interface but ICMP is allowed

OtakarKlier — Thu, 07 Apr 2022 17:03:07 GMT

Hello,

Do you have a security policy to allow the ping to hit the interface? Also for the management interface, i would strongly advise that only specific IP's can get to it.

i.e.

internet -> FW external IP (also a management interface).

This way you can get to the management interface of a remote PAN if you need to.

Hope that helps.

topic Re: No ICMP hitting Palo Interface but ICMP is allowed in General Topics

No ICMP hitting Palo Interface but ICMP is allowed

Re: No ICMP hitting Palo Interface but ICMP is allowed