ICMP problem

waleedfarouk — Sat, 09 May 2020 01:02:51 GMT

I have very simple topology

Huawei switch Eth-trunk----------------Aggregation Palo alto ------------P2P------- Router

In Huawei switch

created two vlan's vlan 10 , vlan 20

interface vlan 10

ip address 172.16.1.100

interface vlan 20

ip address 172.16.2.100

ip static-route 0.0.0.0 0.0.0.0 172.16.1.100

In palo alto

Aggregation with two sub-interfaces

Aggregation.10

vlan tag 10

ip address 172.16.1.1 255.255.255.0

Aggregation.20

vlan tag 20

ip addreass 172.16.2.1 255.255.255.0

Interface toward Router

ip address 172.19.1.1 255.255.255.0

default route 0.0.0.0 0.0.0.0 172.19.1.4

In the router

interface toward firewall

ip address 172.19.1.2 255.255.255.0

default route 0.0.0.0 0.0.0.0 172.19.1.1

The problem

From Huawei switch

I can ping 172.19.1.4 when the source will be 172.16.1.100 but when the source will be 172.16.2.100 , I can not ping

When I changed the default route in the huawei switch to be 0.0.0.0 0.0.0.0 172.16.2.100

at this time I can ping 172.19.1.4 when the source will be 172.16.2.100 but I can not ping 172.19.1.4 when the source will be 172.16.1.00

something wrong in the Palo alto when handling the return echo-reply if the return path is different

Please advise

Re: ICMP problem

waleedfarouk — Sat, 09 May 2020 01:04:52 GMT

Sorry ,

In the router

interface toward firewall

ip address 172.19.1.4 255.255.255.0