topic Re: Unexpect single port disconnection from PA-220 in General Topics

Unexpect single port disconnection from PA-220

CharlesWang — Tue, 27 Nov 2018 08:47:49 GMT

My client's PA 220 cannot reach to his gateway. However, after he has reboot his PA, the connection is back, but only for few hours long! No matter how I have add the MAC address and troubshoot the problem of the system. I have checked both port on therouter and the port on the PA. I have added the MAC address on the ethernet port. I have even chnaged the port. It doesn't contunuse its connection. I have opened this case for the Paloalto support team, but the support, in his first time support, also thought it's the client's router's problem, but it seems that it might not be the issue there.

Re: Unexpect single port disconnection from PA-220

BPry — Tue, 27 Nov 2018 18:36:29 GMT

@CharlesWang,

Does the firewall actually see the port drop, or do you simply lose internet traffic? Is the connection using a static IP or is it using DHCP or PPPoE?

Re: Unexpect single port disconnection from PA-220

CharlesWang — Wed, 28 Nov 2018 09:21:31 GMT

1. I pinged the gateway but the gateway didn't respond, and the ethernet is up. In addtion, I cannot even ping the same domain ip addresses. I have tried to change the port, but it occurs the same problem.

2. The port is static IP.

Re: Unexpect single port disconnection from PA-220

Raido_Rattameister — Wed, 28 Nov 2018 17:58:32 GMT

Remove static arp entry.

> clear arp ethernet1/5

And use same command to ping.

> show arp ethernet 1/5

Do you see arp entry for .89?

Re: Unexpect single port disconnection from PA-220

CharlesWang — Thu, 29 Nov 2018 01:34:28 GMT

I have done what you told me, but it's still not able to reach 61.154.70.89

Re: Unexpect single port disconnection from PA-220

Raido_Rattameister — Thu, 29 Nov 2018 03:05:23 GMT

(incomplete) means that Palo can't resolve ip to mac address.

You claim that afrer reboot it does and then stops after a while?

What about just disconnecting ethernet1/5 and plugging it back?

Connect patch cable from ethernet1/5 to your laptop.

Start Wireshark on your laptop.

Run ping command.

If packets go out from Palo ethernet1/5 then Wireshark should show arp requests where Palo is trying to resolve 61.154.70.89 to mac address.

If you see those arp requests then issue most likely at ISP side.

Re: Unexpect single port disconnection from PA-220

CharlesWang — Thu, 29 Nov 2018 04:12:31 GMT

Yes, after last time reboot, the ethernet 1/5 was able to reach the 70.89 port again, but only for few hours.

The client said they have tried to ping the 70.90 port on PA with the laptop, but the PA port didn't reply the ping request.

The 70.89 port on the router responded the ping request.

Re: Unexpect single port disconnection from PA-220

BPry — Thu, 29 Nov 2018 14:52:48 GMT

@CharlesWang,

The PA by default wouldn't respond to a Ping request, you would have needed to enable this on the interface management profile. The wireshark capture as mentioned by @Raido_Rattameister will tell you if the PA is attempting to send the ARP request or not, or if the router isn't responding to an ARP request.

Re: Unexpect single port disconnection from PA-220

CharlesWang — Fri, 30 Nov 2018 01:05:31 GMT

It's already enabled.

Re: Unexpect single port disconnection from PA-220

Carrey.Zou — Wed, 03 Feb 2021 02:35:26 GMT

How did you solve this problem in the end?