topic Re: Unable to access HTTP & HTTPS in General Topics

Unable to access HTTP & HTTPS

thanhlb — Thu, 17 Oct 2024 07:50:18 GMT

When I switch from passive to active, I can't access the application via http and https. But I can ping and telnet the application via port 443

Re: Unable to access HTTP & HTTPS

PavelK — Thu, 17 Oct 2024 08:09:02 GMT

Hello @thanhlb

thanks for post.

Would it be possible to provide more details?

- What is name of the application? What do you see in Traffic / URL logs?

- Since there is different behavior between active and passive Firewall in HA pair, could you make sure that both Firewalls are in HA Sync status?

Kind Regards

Pavel

Re: Unable to access HTTP & HTTPS

thanhlb — Thu, 17 Oct 2024 08:24:09 GMT

I using ESXi application. With same VLAN I can access, but different VLAN I cannot access.

Re: Unable to access HTTP & HTTPS

PavelK — Thu, 17 Oct 2024 21:43:58 GMT

Hello @thanhlb

thank you for reply.

As a next step I would check Traffic logs to see difference between both VLANs.

Kind Regards

Pavel

Re: Unable to access HTTP & HTTPS

BPry — Thu, 17 Oct 2024 23:12:42 GMT

@thanhlb,

Validate in your traffic logs if you're seeing traffic from the other VLAN or not. It sounds like you're likely running into issues because you haven't enabled Promiscuous on the network interfaces on the ESXi side of things.

Re: Unable to access HTTP & HTTPS

thanhlb — Fri, 18 Oct 2024 02:08:27 GMT

Hello PavelK

The traffic I see is still going right. I can still telnet to esxi with port 443.

Re: Unable to access HTTP & HTTPS

thanhlb — Fri, 18 Oct 2024 02:12:58 GMT

Hello BPry,

I don't think so. Because when I reactivate device 2, I can still access it normally. This shows that there is no need to enable Promiscuous mode.

Re: Unable to access HTTP & HTTPS

BPry — Sat, 19 Oct 2024 05:20:22 GMT

@thanhlb,

Promiscuous mode really isn't an optional thing unless you're manually configuring ESXi to use the MAC native to the firewall on layer3 interfaces. You either have promiscuous mode enabled when using Layer 2, virtual-wire, or tap interface modes or you are using hypervisor assigned MACs when using Layer3 deployments. The issue you have described is indicative of promiscuous mode not being enabled or the hypervisor assigned MAC not being selected. If you haven't done either of these this is expected behavior and you need to do one of the above (depending on how you have things configured) to address it.

Please review https://docs.paloaltonetworks.com/content/dam/techdocs/en_US/pdf/vm-series/10-1/vm-series-deployment/vm-series-deployment.pdf

Re: Unable to access HTTP & HTTPS

thanhlb — Sat, 19 Oct 2024 06:50:08 GMT

Hello BPry,

I tried configuring Promiscuous mode, but still can't access ESXi in other VLAN