topic Re: Secondry ISP not able to ping form external. in General Topics

Secondry ISP not able to ping form external.

m.habib424169 — Sun, 08 Sep 2024 02:18:37 GMT

I have two ISP connected to my firewall.
1. ISP1 is in untrust zone and default route configured metric value is 10.
2. ISP 2 is in WAN1 zone and default route metric value is 15.
3. Both ISP are in same virtual router.

I am facing one issue i cannot ping my ISP2 from external.

My home public ip if i enter static route in the palo alto firewall in virtual router point to ISP2 interface then only from my home i am able to ping ISP2.

Configuretion i made in my PA.

1.policy: WAN1 to WAN1 all allowed any any

2. PBF: configured (Source WAN1 source any) (Destinaiton address any) forward to ISP2 interface and enabled the Enforce Symmetric Return

3. NAT: Source WAN1 Destination WAN1 Destination Interface ISP2 interface source any destination any translated to Dynamic IP And Port to ISP 2 interface.

Dear Expert Please help me to solve my issue?

Re: Secondry ISP not able to ping form external.

SutareMayur — Mon, 09 Sep 2024 06:55:32 GMT

Hi @m.habib424169

While configuring the PBF, select source type as Interface because the symmetric return is based on the incoming/outgoing interfaces then check.

Keep us posted with the status.

Hope it helps!

Re: Secondry ISP not able to ping form external.

m.habib424169 — Mon, 09 Sep 2024 07:04:56 GMT

Yes i also treid method before but still cannot. Please help.

I am slo thinking that my PBF is worng.

Re: Secondry ISP not able to ping form external.

CosminM — Mon, 09 Sep 2024 08:07:18 GMT

Hello @m.habib424169

Your PBF rule should be with action No PBF and enabled Enforce Symmetric Return.

Also, I don't see the meaning of your NAT rule. If you don't disable that NAT rule when you will ping from external your ISP2 interface it will result into a LAND attack and the packet will be silently drop.

Re: Secondry ISP not able to ping form external.

Raido_Rattameister — Mon, 09 Sep 2024 12:25:35 GMT

Are you pinging from the firewall towards ISP?

PBF policies do not apply to traffic sourcing from the firewall.

PBF policies apply only to traffic passing through the firewall.

If you want to send traffic from inside out towards ISP 2 then source zone in PBF policy needs to be INSIDE not WAN1.

Re: Secondry ISP not able to ping form external.

m.habib424169 — Mon, 09 Sep 2024 12:34:53 GMT

I want to ping from external. Actually i want to enable SSLVPN for this interface.

My source is WAN (outside Any public ip) network.

Please advise what configuration i do?

Re: Secondry ISP not able to ping form external.

CosminM — Mon, 09 Sep 2024 12:46:41 GMT

Then you need to configure ECMP on your virtual router and enable symmetric return.

More details can be found https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-networking-admin/ecmp/configure-ecmp-on-a-virtual-router#id7b41dd6b-dcfb-429c-adb1-b955cb15a9c7

Re: Secondry ISP not able to ping form external.

Raido_Rattameister — Mon, 09 Sep 2024 12:48:50 GMT

With ECMP and symmetric return also don't forget to set default route metric to the same (currently 10 and 15).

Re: Secondry ISP not able to ping form external.

m.habib424169 — Mon, 09 Sep 2024 13:12:42 GMT

ECMP in the virtual router can help resolve the issue by allowing the firewall to use both ISP1 and ISP2 simultaneously for outbound traffic. But in my case ISP1 is primary and ISP2 is secondary. And both interfaces are different Zone.

ISP1 is used for internet treffic
ISP2 i want to USE for IPSEC tunnels and SSLVPN treffic.