topic PaloAlto failing communication for Kali Linux in General Topics

PaloAlto failing communication for Kali Linux

raji_toor — Sun, 09 Oct 2022 05:38:30 GMT

Kali, Windows and RHEL installed in a lab behind Palos on a directly connected Vlan. Windows and RHEL have no issue communicating to internet or ping firewall interface. But for Kali, Palo captures show only receive and no transmit or even drop packets.

All 3 are getting IP from DHCP on Palo interface, and share common NAT/security policies, routes . I have even tried removing profiles from the policy.

Ping from Kali to firewall interface shows

Kali

RHEL

Re: PaloAlto failing communication for Kali Linux

A_Astardzhiev — Sun, 09 Oct 2022 15:12:07 GMT

Hi @raji_toor

The packet captures you have shown - where are they taken from? tcpdump from the VMs or packet capture from the PAN FW?

This doesn't seems to be PAN FW specific so I would suggest you to start with the basics:

- Ping Kali VM from firewall - > ping source 192.168.99.1 host 192.168.99.5

- Check if firewall have ARP entry for Kali VM -> show arp <interface-to-kali>

- Repeat the same from Kali VM (it is good to run the ping before checking ARP to generate fresh ARP requests)

My assumption is that Kali VM is not setup properly and most probably either it is using vnic or using wrong VLAN so Kali VM is not actually connected in the same layer3 network as the PAN FW. Above steps are aming to confirm that - if you don't have ARP (incomplete) from FW to Kali or vice versa it seems you don't have layer2 connectivity.

FW operates at layer3, so even if it is blocking the traffic (security rule, zone protection, content inspection etc) you must at least see ARP entry for Kali VM.

If there is indeed ARP entry the best option to understand why traffic is being blocked is to use global conters with packet filter.

Following link describe how to collect this information - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CloNCAS

In summary:

- Enable the filter

- Run twice "show counter global filter packet-filter yes delta yes" (before running any actual traffic to "clear" the delta )

- Run simple ping from Kali VM

- Check global counters again and see what is the output.

Re: PaloAlto failing communication for Kali Linux

raji_toor — Sun, 09 Oct 2022 17:33:22 GMT

Everything was in order, On looking at the routes i found Kali IP assigned to a loopback interface on PA causing duplicate IP issue. On excluding it from DHCP assignment range in PA resolved it.