topic Re: Problem with connectivity to my lab network in General Topics

Problem with connectivity to my lab network

hfakoor2 — Thu, 28 Sep 2023 13:52:32 GMT

So I'm running some PA's inside a Eve-NG lab environment. Everything has connection to everything, including to my local PC with one caveat. When I ping out the PaloAlto firewall to an address I need to specify a source interface or it deems host Unreachable. I believe this is causing my PC to not be able to ping the PaloAlto interfaces either (although it is able to ping routers/other nodes in the eve-ng lab network).

I need my PC to be able to ping the PaloAlto interfaces to run some Python scripts I'm testing.

So I ahve no experience in PA firewalls, with some light hands on work with firewalls in general...

And so I'm pulling my hair out trying to be able to ping the PA firewalls from my PC (there's a static route defined on the PC, it can reach other nodes.. the PA can reach the PC when specifying a source interface.. but neither can reach eachother otherwise). The PA can't reach the other nodes in my lab network without specifying a source address. I have added a default gateway to the directly connected router.

Right now I'm just doing pings, the only difference will be eventually working on SSH, so I can login to the firewalls and run my scripts.

I'm really trying to figure this connectivity issue out if anyone may have suggestions? I went as far as wanting to add the management interface to OSPF, I didn't find anything that allowed me to do that.

Any ideas/leads as to what may be casuing this? I'm thinking if I resolve being able to ping out without specifying a source address, I would also be able to ping in.

Re: Problem with connectivity to my lab network

hfakoor2 — Thu, 28 Sep 2023 14:04:48 GMT

I also set up the default gateway via

set deviceconfig system default-gateway 10.1.5.9 (next directly connected router) no luck 😞

Re: Problem with connectivity to my lab network

Raido_Rattameister — Thu, 28 Sep 2023 14:06:29 GMT

If you don't specify source IP when pinging the ping goes out from mgmt interface.

If you do specify source IP then ping goes out from dataplane interace that has that IP.

Re: Problem with connectivity to my lab network

hfakoor2 — Thu, 28 Sep 2023 14:25:43 GMT

Okay so i don't know what i did.

the very last configuration I did was:

set deviceconfig system default-gateway 10.1.5.9

and now I have full reachability.

And now I can SSH to the device (hopefully) through Python to run my scripts.

I had this command

set deviceconfig system default-gateway 10.1.5.9

configured earlier, as noted by my "show" under configuration mode, but i was force commiting with potential errors...

I just tried it and I have conenctivity from my localhost to the PA firewalls in my lab environment...

Re: Problem with connectivity to my lab network

hfakoor2 — Sat, 30 Sep 2023 20:24:06 GMT

Is this normal behavior. for example when PaloAlto engineers are testing connectivity are they typically specifying a source interface?

Re: Problem with connectivity to my lab network

Raido_Rattameister — Sun, 01 Oct 2023 15:11:10 GMT

As mentioned earlier if you don't specify source IP then ping request goes out from mgmt interface.

So if you want ping to source from specific IP you must specify it.