topic Re: setup pan200 in General Topics

setup pan200

EDSAadmin — Mon, 12 Jan 2015 02:28:03 GMT

i am in the process of setting up a pan 200. i have configured the mgnt interface, 2 interfaces (1 internal, 1 external) each in there own zone and both in the same virtual router. the problem i am having is i cannot get to the internet or should i say have it pass traffic. i can ping all local devices LAN, i can ping this as the gateway on my lan, the mgnt interface. but not out the external L3 interface either by ip or dns. in my virtual router i have it set 0.0.0.0/0 next ip 70.89.96.62 (which is the gateway for my comcast circuit). i confirmed this by setting a static ip on my laptop and plugging it in to the comcast modem. i was able to get out no problem. i have the default policy that comes with the box from the factory allowing any app/port/protocol out any interface as well.

any help would be appreciated. i am sure it is something simple but i cannot find what i am missing. i can post screenshots or the config if i needed

Re: setup pan200

Satish — Mon, 12 Jan 2015 04:56:27 GMT

Hi EDSA,

Please find the below:-

Please check the service route and plz verify in CLI ping source (Wan IP) host www.google.com

Video Link : 1014

Regards

Satish

Re: setup pan200

Satish — Mon, 12 Jan 2015 05:23:43 GMT

Hi..

Also Check the NAT rule.

Regards

Satish

Re: setup pan200

mmmccorkle — Mon, 12 Jan 2015 06:42:54 GMT

EDSAadmin,

You will need to create a NAT rule.

Try the following. In the example, ethernet1/2 is the external/WAN interface.

Please do not forget to mark any 'helpful' or 'correct' responses.

Thanks!

Re: setup pan200

kattaullah — Mon, 12 Jan 2015 06:54:29 GMT

I would also suggest that you read the document "Understanding PAN-OS NAT"

This will give you basic understanding on how to setup NAT ans security policy for various scenarios.

Understanding PAN-OS NAT

Regards

Khan

Re: setup pan200

Wenar — Mon, 12 Jan 2015 08:30:41 GMT

Hi,

you said that you created two interfaces and added a route for 0.0.0.0/0. The default policy is for the virtual wire and doesn't match layer 3 Zones. If you already created a NAT rule like the other guys mentioned, you should create a new policy with the zones from your L3-Interfaces.

Re: setup pan200

EDSAadmin — Mon, 12 Jan 2015 16:46:04 GMT

Hey guys,

i forgot to put the damn outbound NAT Rule in. Everything is working now.

thank you to all that responded.