topic Re: VLAN entry in General Topics

VLAN entry

jeff.noseworthy1 — Thu, 04 Jun 2020 20:12:33 GMT

I have a network with IP addresses in the range of 192.168.100 and 192.168.130 on two singular network cards on the same machine on the local network. Port 4 on the firewall is plugged into another device with the .130 range IP. Port 1 on the firewall is plugged into the local network. I can’t contact the other device from the machine.

Any idea how I can achieve this?

Re: VLAN entry

upelister — Thu, 04 Jun 2020 22:10:20 GMT

Hello,

I think your enviroment like this;

To Check-

İnterface types should be L3 and ip address assigned.
Same default router shoul be used.
1. Else you must crate a routing entry for each subnet in each VR.
You can put them in different zone or same zone up to you.
1. İf different zone, you have to create a rule.
2. İf same zone Default allow rule will allow traffic.
3. İf there is clean up rule before default rules, a permit rule must be created even if they are in same zone.
4. İf there is an allow rule logging should be enabled.
Link States must be Green not red or greyed out.
Assingnin a ping enabled management profile to interface’s good for trouble shooting.
ON cli you can check arp entry’s to verify hosts are connected properly.
1. )> show arp ethernet1/1 or )> show arp ethernet1/4
If you are using VM Palo Alto, “promiscous mode” has to be enabled all interface’s. İn ESX.
For 100.0 network host can ping to its gateway.
For 130.0 network host can ping to its gateway.
Trace route can be helpful.

Have a nice and healty day.

Re: VLAN entry

reaper — Fri, 05 Jun 2020 07:08:30 GMT

If i read your issue correctly you have:

a desktop computer with 2 network cards plugged in, one in range 192.168.100 and one in 192.168.130

your firewall also has 2 connected interfaces, one in 192.168.100 and one in 192.168.130

your desktop is connected with both interfaces in the same broadcast domain to the firewall on the interface with ip 192.168.100

the firewall is connected to a different broadcast domain on the 192.168.130 interface

i don't think there is a (layer3) solution to this issue as your host will always prefer the locally connected subnet over a remotely routed one so it will look for ARP rather than route

you could consider switching your firewall to two layer2 interfaces, and setting up routed vlan interfaces in each subnet

that way both broadcast domains will see eachother and a default gateway will remain available for routing