topic Re: Issue creating multiple DMZs with layer3 interfaces in General Topics

Issue creating multiple DMZs with layer3 interfaces

ailfionn — Fri, 11 Feb 2011 17:00:31 GMT

I have an issue with getting 2 DMZs working in layer 3 mode on Palo Alto version 3.1.7.

I have set up my first DMZ and can communicate perfectly with the internal network. When I setup a second dmz (using completely different interface ports), but exactly the same configuration I cannot communicate from the internal network to the new dmz. Funnily I can communicate perfectly from the new DMZ to the internal but not the other way around. I have enabled policies both ways and if I ping I can see the traffic being allowed both ways.

I have double checked the routing and that seems fine as well.

I have come to th conclusion there must be some simple configuration to solve this that I am missing :smileyconfused:or there is a bug in the Palo Alto software.

Also since I upgraded to version 3.1.7 I get the following error when I do a commit

device: Invalid address value 'NaN'

Anyone had a similar issue

Re: Issue creating multiple DMZs with layer3 interfaces

gswcowboy — Fri, 11 Feb 2011 18:02:11 GMT

Hi,

The warning is a bug in 3.1.7 and Developers are working on a fix. Are you saying that pings indicate 'allow' on the traffic log but dmz to internal pings are not getting a response?

Re: Issue creating multiple DMZs with layer3 interfaces

ailfionn — Fri, 11 Feb 2011 18:42:28 GMT

Thanks for this. I am saying that pings indicate 'allow' on the traffic log but internal to dmz pings are not getting a response?.

I got 2 dmz's working in the last hour by adjusting native vlan on the Cisco switch to the specific vlan and changing every interface to trunking and allowing vlan 1 as well as the vlan I wanted. I am not comfortable that I have actually cracked it yet so any more information would be good.

Re: Issue creating multiple DMZs with layer3 interfaces

mharding — Fri, 11 Feb 2011 19:15:46 GMT

Are both of the DMZ zones on the same Cisco switch? Your could implement router on a stick with the Palo Alto by creating sub interfaces with the VLAN tag.

I would also make sure that the new DMZ interface is in the routing table.

Re: Issue creating multiple DMZs with layer3 interfaces

ailfionn — Fri, 11 Feb 2011 19:34:39 GMT

Cheers,

Yes that is exactly what I changed to. Sub interfaces. They are both on the same switch so obviously I do not want to enable routing on the switch but perform the routing through the PA. I think I am working ok now but will fully test next week.

Thanks for your suggestions