topic reachability issue to PA FW interface vlan in General Topics

reachability issue to PA FW interface vlan

Ahmed_Youssef — Mon, 03 Feb 2020 19:10:21 GMT

there is high-available Paloalto fw PAN-OS 9.0.3-h3 connected to the same switch witch aggregate ethernet interface. interface VLANs created and on the firewall with ip address 10.1.1.1/24 to work as GW for some servers and other interface VLAN as GW for users with ip address 10.1.2.1/24. all thing was working fine and a change was required to make GW on a router that required to change the ip address of the interface vlans after changing the ip address to 10.1.1.88/24 and commit the change is rollbacked and I changed the IP address again to be 10.1.1.1/24.

when checking reachability between servers and FW (ping) it failed for troubleshooting interface vlan created on the switch when ping from fw using source interface 10.1.1.1 to this interface vlan it passed and ping from switch interface vlan to servers it also passed. but from fw to server failed which caused issue between servers and users vlan. when switchover done to passive fw all is working fine.

Re: reachability issue to PA FW interface vlan

reaper — Tue, 11 Feb 2020 13:15:50 GMT

hi @Ahmed_Youssef

it feels like you're trying to explain too much in too few words, could you break it down into a series of events? that may help in troubleshooting with you 🙂

thanks!

Re: reachability issue to PA FW interface vlan

umar00o — Tue, 11 Feb 2020 13:44:51 GMT

Hi Ahemd,

Yes please explain bit more. Also best to start checking all the configs again there must be something you have overlooked or missed.

I am sure mgmt profile is attached to the interface and ping is allowed. you can also try traceroute from the problem server and see where it stops.

Thanks.