topic Troubleshoot VM Panorama with multiple interfaces in General Topics

Troubleshoot VM Panorama with multiple interfaces

aleksandar.astardzhiev — Wed, 12 Feb 2020 11:55:52 GMT

Hi All,

We have few virtual Panoramas running 8.1 that are needs to managed firewalls into two different zones with no connection between them. For that reason we have configured the Panorama with multiple interface.

- The mgmt interface in used for access to the Panorama as well as managing some if the firewalls

- Eth1/1 interface is used for managing the rest of the firewalls in the second zone

We already have few similar setups and everything is working fine. During the last setup we had few typos in the panorama config (the default gw for the eth1/1 was wrong and the fw ip was not in the permitted IPs)

My real problem is that there is no way you can troubleshoot the connectivity between the firewall and the panorama on the second interface.

- The tcpdump command on the panorama is listening only on the mgmt interface and it seems there is no way you can see what is hitting the second interface.

- It seems panorama doesn't support the "packet capture" similar to the firewalls.

- It seems you cannot "show interface" for status and statistics any non-management interface on the panorama

From my point of view there is no way you can confirm if traffic from the firewall is reaching the panorama and if yes, does it reply - if the firewall is connecting to non-management interface on the panorama.

I was hoping if any of you have find some any commands that can help troubleshoot connectivity over non-management interface.

Re: Troubleshoot VM Panorama with multiple interfaces

batd2 — Thu, 20 Feb 2020 15:21:46 GMT

@aleksandar.astardzhiev I am not sure what Panorama model and PanOS version you have, but we have physical M applience on 8.1 and the interface troubleshooting commands are there, e.g."> show interface ethernet1/2", "> tcpdump interface ethernet1/2" .

Re: Troubleshoot VM Panorama with multiple interfaces

aleksandar.astardzhiev — Wed, 26 Feb 2020 07:23:19 GMT

Hi @batd2,

All of our Panoramas are virtual. All of them are running on 8.1 and none of them support the command you have:

user@panorama> show interface management Show management interface information user@panorama> show interface ethernet1/1 ethernet1/1 is not one of <management> Invalid syntax.

It seems that the physical devices are supporting these commands, but the virtual don't. Which is weird...