topic Re: How do I enable ping to a non-mgmt IP address? in General Topics

How do I enable ping to a non-mgmt IP address?

Mon, 04 Jun 2012 22:16:46 GMT

Hello,

I'm trying to enable ping to an external address that is not assigned to an interface? Is this possible? This address is used for NAT'ing purposes or to access an internal server.

I've done the following but I'm still not able to ping the address/server:

1. allow application ping from internet to my external ip.

Am I missing anything?

Thanks

Re: How do I enable ping to a non-mgmt IP address?

mikand — Tue, 05 Jun 2012 07:57:02 GMT

If you have setup DNAT then enabling ping towards the (in your case) server should be the same way as when you enable other types of traffic.

If you want a physical interface of your PA box to reply to ping you need to setup a management profile where you only select "ping" and then attach this profile to that particular physical interface. Im not sure if you need a security rule aswell or not.

Re: How do I enable ping to a non-mgmt IP address?

UhMayYeah — Tue, 05 Jun 2012 18:34:11 GMT

To add to mikand, this traffic needs intra-zone security rule typically Untrust-to-Untrust which is permitted by the firewall by default,unless we have a any-any deny-all rule configured.

Interface will proxy-arp for all the addresses lying in it's subnet.So adding an interface-management profile allowing ping service should take care of things .

Please refer :https://live.paloaltonetworks.com/docs/DOC-2998#cf

Re: How do I enable ping to a non-mgmt IP address?

Tue, 05 Jun 2012 18:38:19 GMT

Thanks guys. Let me try these out and get back to you with results.

Appreciate the help!

Re: How do I enable ping to a non-mgmt IP address?

Wed, 06 Jun 2012 14:52:56 GMT

Thanks guys, it seems like it is working. Thank you for that. The only concern that I have is I'd have to have a NAT rule that has the service any for this to work. How do I further restrict this so that only ping is allowed on the NAT rule? Is this possible?

NAT Rule looks like this:

Source [Untrust IP]

Destination [Untrust IP]

Service [Any]

Translated Address: [Internal Server IP]

Security Rule looks like this:

Source [Untrust IP]

Destination [Untrust IP]

Application [ping]

Action [Allow]

Re: How do I enable ping to a non-mgmt IP address?

UhMayYeah — Wed, 06 Jun 2012 15:39:48 GMT

Security Rule ::

Source Zone [Untrust IP]

Destination Zone [Trust]

Source IP [any]

Destination IP [Untrust IP - Original destination Ip/Non_translated IP]

Application [ping]

Action [Allow]

N.B:Please make sure this specific rule is above other generic rules with context -Source Zone[Trust] -Destination Zone [Trust].

Refer :: https://live.paloaltonetworks.com/docs/DOC-1517