topic Re: Layer 3 sub interfaces on Hyper-V in General Topics

Layer 3 sub interfaces on Hyper-V

JanDoniger — Wed, 19 Oct 2022 16:12:19 GMT

Hi all,

I am trying to get Palo Alto VM series (10.2.3) to work with layer 3 sub interfaces on Hyper-V (2022).
I configured interface/subinterface from the documentation (https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRkCAK)

I also tried it with removing the ip.adr 192.168.4.252/24
I also tried setting the vSwitch to trunk mode on the Hyper-V host with
Set-VMNetworkAdaptervlan -VMName PA -VMNetworkAdapterName "PA-LAN-Switch" -Trunk -AllowedVlanIdList "1-7" -NativeVlanId 0

I can ping between vms on the vlan 7 ... but I cannot ping the PA IP (192.168.7.252)
If I remove the subinterface and the vlan tagging in the Hyper-V Host I can ping 192.168.4.252.

Any help would be appreciated,

Best Regards

Re: Layer 3 sub interfaces on Hyper-V

OtakarKlier — Wed, 19 Oct 2022 20:49:55 GMT

Hello,

Here is how I have set this up in the past. However I make my physical interfaces layer2, trunk the vlans, and then make layer3 vlan interfaces on the PAN. This I feel allows for more control and forces all traffic to pass through the PAN.

Then on the Hyper-V side make sure you tag the vlans appropriately. When you create a VM, make sure you use static MAC's and also have the VM tag the network packets. The interfaces are not pingable by default. You need to configure a management profile that allows pings, then attach it to the interface. You will also need security policies to allow the ping.

Hope this helps.

Re: Layer 3 sub interfaces on Hyper-V

JanDoniger — Thu, 20 Oct 2022 10:50:55 GMT

Hi,

Thank you for your advice.

I tried Layer 2 with

and still no luck.
I used

Set-VMNetworkAdapterVlan -VMName web01 -VMNetworkAdapterName web01-LAN-Switch -Access -VlanId 7
tried static MACs ... and even

sudo ip link add link eth2 name eth2.7 type vlan id 7
I created a ping managment profile and added a any/any for icmp/ping policy.
For some reason I can ping from the hvper-v host (when added to the vlan 7) the web01 but not the Palo Alto Interface.

Any Ideas?

Best Regards

Re: Layer 3 sub interfaces on Hyper-V

OtakarKlier — Fri, 21 Oct 2022 14:34:57 GMT

Hello,

I would say the PAN config is correct. Might want to recheck the Hyper-V side:

If using a Teamed interface make sure its tagged:

Then on the VM settings:

Sorry I cant find my notes from when I built everything. It was a long time ago.

Hope this helps.

Cheers!

Re: Layer 3 sub interfaces on Hyper-V

JRzepka — Sat, 25 Mar 2023 00:23:00 GMT

I have an almost identical setup. It was working great on 10.1.3 and 10.1.8 for many months. Once I upgraded to the 10.2.0 and above line (I am on 10.2.3-h4 now) Vlan traffic will not pass my sub-interfaces. The arp's are not passing and getting dropped due to vlan tags not getting appended to the packets it appears. It must somehow be related to Hyper-V. We are gathering data in my TAC case and they said the fix will be in 10.2.4 when that version comes out.

Re: Layer 3 sub interfaces on Hyper-V

JRzepka — Fri, 31 Mar 2023 13:45:53 GMT

I can confirm that the new version 10.2.4 fixes this issue now.

Re: Layer 3 sub interfaces on Hyper-V

Emersonarredondo — Wed, 03 May 2023 15:06:55 GMT

and 11.0.1

Re: Layer 3 sub interfaces on Hyper-V

RGomesPT — Thu, 22 Jun 2023 21:37:44 GMT

I am facing this issue on 11.0.. will try to update to 11.0.1 to see if it fixes the issue