topic Re: Virtual Wire silently discarding packets directed to ip addresses of a L3 interface in General Topics

Virtual Wire silently discarding packets directed to ip addresses of a L3 interface

cnrpisa — Wed, 20 Jul 2011 12:24:52 GMT

I have a PA-4020 with PanOS 4.0.3. Policies are mailnly applied to traffic flowing through two parallel Virtual Wires. I have also defined some L3 interfaces , in order to set up some SSL-VPNs. I have noticed that packets whose destination IP address is the IP address of an L3 interface are not allowed to go through the Virtual Wires, even if my policies permit their transit. There is non trace of the discarded packets in the logs. I suspect this is a bug. Did others experiment the same problem?

Re: Virtual Wire silently discarding packets directed to ip addresses of a L3 interface

pkruse — Tue, 26 Jul 2011 16:54:53 GMT

You going to need to provide some topology information. Your description sounds as though you have two L3 interfaces in parallel with two sets of vwire interfaces. If you are convinced this is a bug it will require a case be opened with technical support so that it can be reproduced and a bug generated so that it can be fixed.

~Phil

Re: Virtual Wire silently discarding packets directed to ip addresses of a L3 interface

cnrpisa — Tue, 26 Jul 2011 18:04:17 GMT

I've enclosed a picture showing my setup. In the situation described in the picture, pings sent from 146.48.99.254 to 146.48.99.251 time out. All other pings from 146.48.99.254 to other addresses in subnet 146.48.96.0/22 succeed. If the virtual wire is bypassed, 146.48.99.254 can ping also 146.48.99.251.

My intention was to use 146.48.99.251 as a gateway for an SSL-VPN. I have found a work-around, so I can survive even with this strange behaviour of the PA-4020.

Before submitting a case, I would like to know if my planned setup was wrong.

Re: Virtual Wire silently discarding packets directed to ip addresses of a L3 interface

jdavis — Wed, 27 Jul 2011 02:01:12 GMT

cnrpisa wrote:

My intention was to use 146.48.99.251 as a gateway for an SSL-VPN. I have found a work-around, so I can survive even with this strange behaviour of the PA-4020.

Before submitting a case, I would like to know if my planned setup was wrong.

cnrpisa,

Do you have a managment profile that allows ping applied to interface e1/1.96 on the PA-4020? It sounds like this is the problem based on the information you've provided. Remember, the firewall's interface will not reply to pings without a management profile that allows ping applied to that interface.

Best Regards,

Jared

Re: Virtual Wire silently discarding packets directed to ip addresses of a L3 interface

cnrpisa — Wed, 27 Jul 2011 06:56:07 GMT

The management profile of Ethernet1/1.96 is OK. The proof is that when I bypass the Virtual Wire by connecting the M7i directly to the LAN switch all pings succeed.

Re: Virtual Wire silently discarding packets directed to ip addresses of a L3 interface

pkruse — Mon, 08 Aug 2011 20:48:59 GMT

Does your monitor show the ping? Can you see the session from the CLI?

"show session all filter source xxx.xxx.xxx.xxx application ping"

Re: Virtual Wire silently discarding packets directed to ip addresses of a L3 interface

cnrpisa — Wed, 07 Sep 2011 10:08:53 GMT

The problem has been eliminated in version 4.0.5.