topic Re: MGMT routing issue in General Topics

MGMT routing issue

young19918 — Thu, 16 Feb 2023 12:40:08 GMT

Hello,

How can I get MGMT to ping to the LAN port?

Any help is appreciated.

Re: MGMT routing issue

kiwi — Thu, 16 Feb 2023 14:08:23 GMT

Hi @young19918 ,

Using the command ping host <IP address> and you will automatically ping from your mgmt interface:

Kind regards,

-Kiwi.

Re: MGMT routing issue

young19918 — Thu, 16 Feb 2023 14:28:05 GMT

Hi @kiwi ,

Thanks for your reply.

I've tried this before, but had some problems ...... (as shown in the picture below)

These two red boxes show the source should be the same (mgmt), but one works and the other doesn't ......

And it can also ping the LAN port of the PA, why can't ping a server with port docking? (192.168.30.1)

Any help is appreciated.

Re: MGMT routing issue

OtakarKlier — Thu, 16 Feb 2023 18:04:31 GMT

Hello,

Is what you are attempting to ping in a different vlan or security zone? Could be the PAN blocking you?

Regards,

Re: MGMT routing issue

Adrian_Jensen — Thu, 16 Feb 2023 18:15:44 GMT

In addition to what @OtakarKlier suggested, do you have ping enabled on the Data interface? Every interface has a Management Profile which lists the services that are allowed to run on that interface (except the Management interface which is handled a little bit differently). The interface Management Profile can be found under: Network-Interfaces->[interface_config]->Advanced->Other Info-Management Profile.

The Management Profiles define which services (ping, HTTP/HTTPS, SSH, etc.) can run on an interface and are configured from: Network->Network Profiles->Interface Mgmt

Re: MGMT routing issue

Raido_Rattameister — Thu, 16 Feb 2023 19:19:55 GMT

Is 10.2.100.54 your firewall management interface or have you enabled Interface Management profile on dataplane interface with IP 10.2.100.54?

ping host 1.1.1.1 (ping request goes out from mgmt interface)

ping source x.x.x.x host 1.1.1.1 (ping goes out from dataplane interface with IP x.x.x.x)

Re: MGMT routing issue

young19918 — Fri, 17 Feb 2023 01:35:28 GMT

Hi @Raido_Rattameister ,

Thanks for your reply.

Now I know the difference between these two.
But I still have a question, if can ping to 192.168.30.254, why can't ping to 192.168.30.1 (architecture diagram below)

Any help is appreciate.

Re: MGMT routing issue

Raido_Rattameister — Fri, 17 Feb 2023 03:06:50 GMT

Well command "ping host 192.168.30.1" sends ping out from management interface.

Something needs to route from 10.2.100.x network to 192.168.30.x network.

Packet don't jump from management plane to dataplane inside firewall. Those packets will actually exit from management interface and need to be routed to different subnet to reach 192.168.30.1

Re: MGMT routing issue

young19918 — Fri, 17 Feb 2023 03:12:29 GMT

Hi @Raido_Rattameister ,

Thanks for your reply.

It looks like there should be

Re: MGMT routing issue

Raido_Rattameister — Fri, 17 Feb 2023 03:14:33 GMT

Do you have any dataplane interface with 10.2.100.x IP.

What is default gateway IP configured on mgmt interface?

Re: MGMT routing issue

young19918 — Fri, 17 Feb 2023 03:17:41 GMT

Hi @Raido_Rattameister ,

Yes,I have.Here is my structure :

Re: MGMT routing issue

Raido_Rattameister — Fri, 17 Feb 2023 03:24:54 GMT

In "Monitor > Traffic" you should see traffic from 10.2.100.54 to 192.168.30.1

If you don't then check that you have overridden interzone-default rule at the bottom of the ruleset and chosen "Log at session end".

If you see sessions but no return packets then OS firewall is blocking incoming ping.

Re: MGMT routing issue

young19918 — Fri, 17 Feb 2023 03:43:18 GMT

Hi @Raido_Rattameister ,

Thanks for your reply.

Yes,I have chosen "Log at session end".

But I can't see any session...

Re: MGMT routing issue

Raido_Rattameister — Fri, 17 Feb 2023 04:01:56 GMT

Is management port connected somehow to ethernet1/1 (either directly or through switch)?

What is output of "traceroute host 192.168.30.1"?

Re: MGMT routing issue

young19918 — Fri, 17 Feb 2023 04:07:06 GMT

Hi @Raido_Rattameister ,

It seems that MGMT is first sent to the outside of the core and has no way to switch itself in the PA.

Re: MGMT routing issue

Raido_Rattameister — Fri, 17 Feb 2023 04:10:28 GMT

Can you send screenshot of management interface settings (Device > Setup > Interfaces > Management)

Re: MGMT routing issue

young19918 — Fri, 17 Feb 2023 04:56:40 GMT

Hi @Raido_Rattameister ,

Re: MGMT routing issue

Raido_Rattameister — Fri, 17 Feb 2023 05:02:44 GMT

But you are not routing traffic from management interface to server through Palo.
If management interface had default gateway 10.2.100.55 it would send traffic to ethernet1/1, through Palo and towards server (192.168.30.1).

You are sending traffic to 10.2.100.254 that is some other device not previously discussed in this thread.

Re: MGMT routing issue

young19918 — Fri, 17 Feb 2023 05:18:33 GMT

Hi @Raido_Rattameister ,

Please refer to the picture below, is it true that "MGMT ping to Server" can only take the blue path to the server, while the red path is not possible?

Re: MGMT routing issue

Raido_Rattameister — Fri, 17 Feb 2023 05:21:54 GMT

Traffic can only take blue path.

There is no interconnection or routing between management module and dataplane (LAN on your diagram) inside Palo.

Packets from sourcing from management interface physically leave management interface to get to the destination.