topic Re: Newbie looking for some guidance in General Topics

Newbie looking for some guidance

walter35161 — Wed, 01 Feb 2023 14:21:43 GMT

Hello everyone. I am new to Palo Alto firewalls. We have bought many new PA-440's and I am having trouble with my very first installation.

I have a site that is currently using a TP-Link AX1500 router.

Very simple setup.... ISPmodem----WANportOfAX1500/LANportOfAX1500----Clients.

I have tried, without success, to mimic the setup of the AX1500 and replace it with the PA-440. I have the PA-440 acting as a DHCP server. My clients get IP addresses, and then can ping the PA-440. They cannot ping anything on the Internet. From the PA-440 command line, I also cannot ping anything on the Internet (ping host 8.8.8.8 for example).

I know this post leaves many questions, but is there a guide on a very basic setup like this? I am sure I am missing something small but have been unable to put my finger on it.

Thank you -- Walter

Re: Newbie looking for some guidance

Raido_Rattameister — Wed, 01 Feb 2023 14:32:52 GMT

"ping host 8.8.8.8" sends ping requests out from Palo mgmt interface.

For this to work mgmt interface needs to be connected, NAT and security policy need to be in place.

Do you see those sessions under "Monitor > Traffic"?

By default "interzone-default" and "intrazone-default" rules don't log so it is suggested to override them and check "Log at session end" on Actions tab.

You can also try "ping source 1.2.3.4 host 8.8.8.8" (replace 1.2.3.4 with your WAN IP).

In this case ping goes out from WAN interface. NAT is not needed and by default "intrazone-default" rule will permit this traffic.

If you share output of your results we can help you get them connected.

Re: Newbie looking for some guidance

walter35161 — Thu, 02 Feb 2023 21:32:25 GMT

Thank you very much for responding.

I am now working on the bench in my office. I have two Windows laptops, one Windows PC, and the Palo.

I have attached a picture of the connections.

The Palo can successfully ping either of it's own interfaces (10.10.150.1 or 24.197.46.86).
Palo cannot ping either laptop from the command line.
Dell laptop can ping 24.197.46.86, but not 10.10.150.1.
HP laptop can ping 10.10.150.1, but not 24.197.46.86.

I am sure I am missing something fundamental.

Re: Newbie looking for some guidance

Raido_Rattameister — Fri, 03 Feb 2023 02:09:00 GMT

Can you share screenshot of security and nat policy?

Have you permitted incoming ping in laptops (or disabled firewall)?

Re: Newbie looking for some guidance

walter35161 — Fri, 03 Feb 2023 14:28:28 GMT

I have the Windows firewall disabled on both laptops. Just to make sure of pingability, I changed one laptop to match the subnet of the other laptop, cross-connected them via Ethernet, and they were able to ping each other.

I am attaching 7 screenshots. Thanks again for your help.

Re: Newbie looking for some guidance

Raido_Rattameister — Fri, 03 Feb 2023 14:40:46 GMT

Those 2 commands don't work?

ping source 24.197.46.86 host 24.197.46.85
ping source 10.10.150.1 host 10.10.150.51

Re: Newbie looking for some guidance

walter35161 — Fri, 03 Feb 2023 15:07:20 GMT

Yes, both of those commands do work. I apologize... I thought "ping host 10.10.150.1" would work.

I get replies using both of these commands:

ping source 24.197.46.86 host 24.197.46.85
ping source 10.10.150.1 host 10.10.150.51

Re: Newbie looking for some guidance

Raido_Rattameister — Fri, 03 Feb 2023 15:30:33 GMT

If you don't specify source IP (like ping host 10.10.150.51) then ping requests go out from mgmt interface.

There is no interconnection inside firewall between mgmt port and dataplane port.

For mgmt port to have connectivity you need to connect fw internal interface and mgmt port into switch so they can see each other.

Re: Newbie looking for some guidance

BPry — Fri, 03 Feb 2023 17:54:24 GMT

@walter35161,

You don't appear to be logging your interzone-default policy, for troubleshooting I'd enable that so you can ensure that the traffic is actually being processed properly and isn't getting dropped. Couple things I would look at:

Traffic Logs - Do you see this traffic in your current traffic logs at all? If you have it recorded in the logs as being allowed, make sure that you've actually verified via the detailed log view that things are routing properly and going out the proper interface. If you don't have records prior to enabling the interzone-default logging, this traffic wasn't matching your rules and getting dropped.
Routing - Kinda covered this above, but make sure that your traffic is actually routing properly via your traffic logs.