topic Re: Basic Palo Alto configuration Help in General Topics

Basic Palo Alto configuration Help

gondolf — Sat, 20 Apr 2024 05:10:17 GMT

I am very new to PA firewalls.

To understand the firewalls I have setup a lab and also worked on the physical firewall.

Following my topology

PA - Switch - PA

VLAN 100

Ip : 192.168.1.5/30 and 192.168.1.6/30

Zone WAN

Mgmt profile : ping enable

interface : L3

sub interface 1/1.100 - tag 100

Nothing else is configured.

I am trying to ping each other but no luck.

Can someone please help me to understand what am I missing?

I am happy to give any output or access to my online lab.

I have done the capture all traffic and I can see ARP request has been received but there is no reply.

My lab is to configure the BGP .. I am trying to check if I can setup the following BGP .

FW 1 1/1.100 --- 192.168.1.5/30

FW 3 - 1/1.100 --- 10.1.1.5/30

FW 2 - interface 1/1.100 ---- 192.168.1.6/30 and 10.1.1.6/30

Re: Basic Palo Alto configuration Help

OtakarKlier — Sun, 21 Apr 2024 17:05:26 GMT

Hello,

I suggest start simple. Static routing and verify you can ping between the firewalls. Do you have security policies in place to allow ping on both devices? When you ping from the command line, the default is to use the management interfaces, however you can tell it to use other interfaces to ping from.

ie ping host <destination IP> source <source IP> ( I might have gotten which comes first, eg host or source in the wrong order)

Regards,

Re: Basic Palo Alto configuration Help

gondolf — Sun, 21 Apr 2024 22:59:39 GMT

Thank you for reply, Toplogy is very simple.

FW mgmt -- vlan 10 on switch -- mgmt FW -> ping works fine

FW 1/1.100 - vlan 100 on switch -- 1/1.100 FW --> Ping dose not work.

Switch can see both the Firewall IP address on vlan.

Firewall can see the arp query from other firewall but I can't see firewall is sending any reply for the arp.

I am not sure if by default PA block the ARP or do I have to do something special?