topic Layer 3 routing on PA in General Topics

Layer 3 routing on PA

zaidshaikh — Mon, 22 Jun 2020 09:23:56 GMT

Guys, facing a small issue hope can resolve together

I have created a new network on PA as Layer-3(503) and am trying to communicate with my other existing layer-3 network (501):

Steps configured are as follows :

1) created Layer-3 ae4.503 with IP X.53.1 and existing is ae4.501 with IP X.50.1

2) Policy from both either network

3) Policy based forwarding specific from 501 to 503; Pbf is configured to avoid route lookup

4) also Source NAT is created from 501 to 503

5) Access switch is configured with vlan and interface IP for both.

when is try ping from access switch to PA ---- SUCCESS

Now i try ping from my PC which is in 501 vlan am unable---- NO SUCCESS

i see hit-counts increase on PA policy, pbf and sNAT; but ping from my PC is FAILING...

Help

Re: Layer 3 routing on PA

reaper — Mon, 22 Jun 2020 13:45:47 GMT

@zaidshaikh

why do you need to avoid route lookup?

your configurations is incredibly complex for and very simple topology, so i would like to understand

if you are pinging from your pc in vlan 501 to palo alto ip in vlan 503, you are most likely performing a land attack on yourself (source nat to the interface ip, while destination is also interface ip = illegal source + destination combination)

try pinging the remote vlan ip

Re: Layer 3 routing on PA

zaidshaikh — Mon, 22 Jun 2020 15:45:21 GMT

Static routes are configured for traffic destined to DC-FW (or dmz traffic) and the new network which i made is for management of my external facing devices.

About snat config even i wasnt sure of as my source is 501 ip and destination is the interface ip on PA.

Anyways i tried to ping from 501 to 503 but am not getting ping responses i.e Fails

if i try ping on switch as:

ping x.x.53.1 source x.x.51.1-------- ping Success

On PA

ping source x.x.53.1 host x.x.51.1 ------- ping success

But on LAN PC no PING Responses.