topic Re: Incomplete ARP when deployed in Azure in General Topics

Incomplete ARP when deployed in Azure

vravindra — Mon, 09 Mar 2020 20:20:39 GMT

Hello,

I deployed NGFW 8.1 using Terraform (v0.11.36) in Azure. It provisions VM and all the resources like resource group, VNet, subnet, IP's etc., But the only problem is with the UnTrust(eth1/1) NIC as it complains 'Incomplete ARP even after configuring the Interfaces and the static routes in Virtual router page. I only get this problem when I do it using Terraform and not using the Azure's solution template or ARM templates.

Did anyone had the same issue? and can I know how was it resolved? thanks in advance.

Regards,
Vishnu

Re: Incomplete ARP when deployed in Azure

BPry — Tue, 10 Mar 2020 02:38:21 GMT

@vravindra,

This can be a large number of things, without additonal insight into how you have things configured saying exactly what it is isn't going to be possible. I personally would be reaching out to TAC so that someone can actually look at how a firewall you are deploying is actually configured. A few things to check though:

The firewall has corresponding routes for all subnets pointing to the first IP of the subnet the firewall is attached to.
Ensure the interface itself has IP Forwarding enabled on the Azure side of things when configured through terraform.
The UDR is being properly assigned to the subnets.

Re: Incomplete ARP when deployed in Azure

vravindra — Wed, 11 Mar 2020 14:57:04 GMT

Hello @BPry

Thanks for responding, appreciate it.

My issue is the basic NGFW deployment using the 'PAYG' azure marketplace. This is only for evaluation/PoC.

I compared the templates of the NGFW for both the deployments using Terraform and the Azure solution template, it is similar but not sure why the untrust nic complains for ARP. I did contact the Palo Alto support but since they don't officially support the Terraform, it did not get solved.

I can share with you the Terraform file if you would like to look at it and give me some comments.

Regards,
Vishnu

Re: Incomplete ARP when deployed in Azure

ashleyk — Thu, 02 Jul 2020 16:41:11 GMT

Hello,

Im completely deployed via terraform. Azurerm for the virtual machine and panos for configuration.

Check out my post here
https://live.paloaltonetworks.com/t5/general-topics/azure-palo-alto-arp-not-found/m-p/336411/thread-id/84754/highlight/false#M84756

I think it might help you out.

Thanks