topic Routing driving me crazy in General Topics

Routing driving me crazy

rjdahav163 — Mon, 30 Dec 2019 03:42:21 GMT

Hi folks,

here's a weird issue!

We have one public IP lets say 1.2.3.4.

Our PA VM 300, can ping to any public IP address other than 1.2.3.4.

For all other public IP addresses, it sends traffic via default route out of external interface. But for 1.2.3.4, it sends the traffic to our management gateway. Following to be noted:

1. 1.2.3.4 is our other PA firewall external IP where we were trying to connect using IPSec S2S tunnel. I deleted all the tunnel config since I was afraid that it was somehow interfering with the routing. But that did not solve the problem.

2. From all other devices we can ping 1.2.3.4 and ping is allowed on this interface.

3. Security Policies, NAT and static default route pointing out from external interface to next hop are all correct.

4. We can ping other public IP addresses like 8.8.8.8 and even FQDNs like www.facebook.com but only traffic to 1.2.3.4 is routed through management interface.,

Any ideas anyone?

Re: Routing driving me crazy

rjdahav163 — Mon, 30 Dec 2019 03:47:15 GMT

Also,

we tried using

ping host 1.2.3.4

ping source <our_public_interface_addr> host 1.2.3.4

No luck using both!

Re: Routing driving me crazy

Rajesh12 — Mon, 30 Dec 2019 04:19:55 GMT

@rjdahav163

Whenever you try to ping an IP from firewall, by default it will use your mgmt plane and then will forward traffic to gateway configured for mgmt plane. It wont look up firewalls routing table. If you specify source as specific data plane interface, then it will use that interface IP as source and will look into your routing table to forward the traffic.

for ping host 1.2.3.4

It is expected to go through mgmt plane as you have not defined any specific source. Validate if anything is blocking this PING traffic on the gateway of your mgmt plane or on further hops.

for ping source <our_public_interface_addr> host 1.2.3.4

This sounds like intrazone traffic and will exit through your external interface. There is chance that you might not notice traffic log for this if log generation is not enabled on default intrazone rule. Also as peer device is PA, validate if you have applied any interface management profile on the external interface of peer firewall which is restricting PING to only certain IP's.

Re: Routing driving me crazy

rjdahav163 — Mon, 30 Dec 2019 21:34:42 GMT

@Rajesh12

Everything was configured correctly.

You know what solved the problem?? - Firewall Restart 😐

Re: Routing driving me crazy

Rajesh12 — Tue, 31 Dec 2019 01:15:10 GMT

Mighty restart to the rescue. Glad your issue is resolved @rjdahav163