topic Re: VPN user cannot access another network segment in General Topics

VPN user cannot access another network segment

RIS — Wed, 17 Jul 2013 08:55:46 GMT

Hi All

I just established a VPN between two sites. the user over the site has no issue contacting my LAN IP segment (172.20.4.X) and but they just couldnt access to another of my LAN IP segment (172.20.6.x)

I have check under the virtual router that segment was already included. did I miss out on something or where should I be looking at?

Thank for helping guys!

Re: VPN user cannot access another network segment

UhMayYeah — Wed, 17 Jul 2013 09:18:42 GMT

1>Check if the traffic for (172.20.6.x) is able to egress out of Peer firewall.

2>PA firewall is able to reach this segment locally using source ping. (>ping source <LAN i/f IP > host <IP in (172.20.6.x>

3>Security Rule configured for Tunnel-zone to LAN Zone is allowing IP segment (172.20.6.x) on PA firewall.

If tunnel interface has been configured under a separate zone ,you would be able to dig in using traffic logs,if the traffic is reaching PA firewall.

Re: VPN user cannot access another network segment

mbutt — Wed, 17 Jul 2013 16:59:50 GMT

If the tunnel is not between two Palo Alto Firewalls make sure that you have proxy ID's under Network---> IPSec Tunnels for the network that is not able to pass the traffic.

Also if that is not the case to further debug you can also do the following to see what might be causing the issue

1. Need to setup the filters for the traffic we are interested in. To do this, execute the following steps:

Navigate to Monitor--Packet Capture

Click 'Manage Filters'

Set Filter ID 1 to be the source IP and destination IP of traffic you feel is affected ( leave all other fields blank )

Set Filter ID 2 to be the exact inverse of what you did in step 3 (destination IP in source field, Source IP in destination field)

2. Setup up the captures

Create and name the file stage for a packet capture on all the stages (receive, transmit, firewall and drop)

3. Enable filters and captures

debug dataplane packet-diag set filter on

debug dataplane packet-diag set capture on

4. open 2 CLI windows

on 1 run the following command to look at the counter ( make sure it run this command once before running the traffic)

show counter global filter packet-filter yes delta yes

on the 2nd window run the following command to look at he sessions

show session all filter source <ip address> destination <ip address>

5. Now run the test for ftp while it is failing to look at the counters and captures and sessions to determine what is causing the issue.

6. Once you have finished testing and capturing. Make sure to turn off the debugs.

Thanks

Re: VPN user cannot access another network segment

RIS — Thu, 18 Jul 2013 02:53:40 GMT

The issue is resolved and this is what I did.

I realise that the VPN tunnel over the other site is only pointing to my LAN IP segment (172.20.4.X) and not the other segment. I added the 172.20.6.x segment into the VPN tunnel

I am not sure if adding the IP segment under the Proxy ID of the Palo Alto is the resolution of my issue. But i did that and once I commit the policy, the ping test start to show reply.

I didnt try the packet capture test