topic Re: Simple FW Setup in General Topics

Simple FW Setup

jl5678 — Thu, 23 Jan 2014 15:48:21 GMT

I have a PA-200 that I'm trying to set up in a simple lab environment. Eth1 is configured as a layer 3 interface with a public IP on it and Eth2 is configured as a layer 3 interface with an internal IP address on it. Eth2 is configured to hand out DHCP requests to internal client, which happens successfully and the internal clients can also ping their default gateway, which is the IP on interface Eth2. Also, while connecting to the PA-200 via SSH, I am able to successfully ping internet hosts, however, the internal hosts can not access the external hosts. I have the NAT set up properly as well as the access rules. The weird part about all of this is that connectivity to the internet works for approximately 10-15 seconds after a reboot of the PA-200. This is happening on two separate boxes, so I do not believe it is a hardware issue. I guess my question is has anyone seen this before, or have any configurations ideas to correct this?

Re: Simple FW Setup

HULK — Thu, 23 Jan 2014 17:57:08 GMT

Could you please share/upload your firewall config in an xml file, so that I will test in my PA-200 FW and let you know the corrective action should be taken.

Thanks

Re: Simple FW Setup

rmonvon — Mon, 27 Jan 2014 18:28:59 GMT

Is your internal network flat and all devices are pointing to the PA-200 as their default gateway? If so, how many hosts are on your network as the total count may exceed the ARP table on the PA-200. Thanks.

Re: Simple FW Setup

Gregoux — Mon, 27 Jan 2014 22:40:48 GMT

Hello

what do you configured as default gateway for internet access?

could your public ip ping this default gateway?

regard's

Re: Simple FW Setup

pulukas — Tue, 28 Jan 2014 01:26:35 GMT

The issue will be with either the security policy or the nat policy.

On the monitor tab have a look at both security and nat logs after the attempts to reach the internet from the internal hosts.

Re: Simple FW Setup

jl5678 — Wed, 26 Feb 2014 21:18:23 GMT

This issue came down to duplicating the public IP address. We have a block of static IP addresses...when I reboot the FW, communication works for approximately 10-15 seconds until the router figures out another device already has that IP. There were not any logs on the PA-200 that indicated this...I just tried to use another IP in our net block. Thank you all for your suggestions.

Re: Simple FW Setup

ericgearhart — Thu, 27 Feb 2014 15:08:05 GMT

jl5678 can you mark this question as answered?