topic Internet Outage Occurs After Migration - All Packets Aging-out in General Topics

Internet Outage Occurs After Migration - All Packets Aging-out

PAN-Bariz2020 — Wed, 22 Jul 2020 16:11:59 GMT

Hi,

I am working on a Palo Alto Networks Firewall migration project. I exported and imported the configuration with a few errors that I fixed and when migrating from the old to the new PA-3220 firewalls. All internal communications wtih LDAP and other servers are working and the routing protocols are coming up internally and externally. I can also ping the default gateway of ISP from the outside interface of the new Firewall, but the internet is totally down. I checked the traffic under monitor and found that all the packets are aging-out although they are all allowed.

I do have default gateway setup and a default route towards the gateway, I checked the arp and routing table looks fine. What is the issue? anybody please?

Re: Internet Outage Occurs After Migration - All Packets Aging-out

jwolach — Wed, 22 Jul 2020 16:25:52 GMT

Did you check your Source NAT policy to make sure that the packets are getting the correct Public IP Address before hitting the Internet?

Re: Internet Outage Occurs After Migration - All Packets Aging-out

PAN-Bariz2020 — Wed, 22 Jul 2020 16:45:46 GMT

Yes! Security Policy and NAT rules are working according to the monitor tab. I see packet send but 0 on the packets received.

Re: Internet Outage Occurs After Migration - All Packets Aging-out

OtakarKlier — Thu, 23 Jul 2020 22:00:58 GMT

Hello,

Hopefully you have this corrected already. However unplug the external interface for a few minutes to see if the ISP can clear their ARP. Or just call them and see if they see traffic and it they can clear the arp tables.

Regards,

Re: Internet Outage Occurs After Migration - All Packets Aging-out

PAN-Bariz2020 — Thu, 23 Jul 2020 22:04:19 GMT

I did [show arp all] and found the ISP router gateway ip address has a proper arp cache. I also did a traceroute, but found a couple of hopes after the gateway is not being properly resolved, instead of IP address there was *** which indicates arp cache issue at that nodes. It is still not solved, i am following that closely.

Re: Internet Outage Occurs After Migration - All Packets Aging-out

SutareMayur — Fri, 24 Jul 2020 14:20:47 GMT

@PAN-Bariz2020Check under Source NAT rule if translation type is selected as Dynamic IP And Port but not Dynamic IP only. This will create issue if other option is selected.

Mayur

Re: Internet Outage Occurs After Migration - All Packets Aging-out

PAN-Bariz2020 — Fri, 24 Jul 2020 15:31:29 GMT

Dynamic IP And Port is selection, some of them also have bi-directional option checked.

Re: Internet Outage Occurs After Migration - All Packets Aging-out

MP18 — Mon, 27 Jul 2020 00:10:15 GMT

@PAN-Bariz2020

1>Did you check the traffic logs that traffic is getting natted to public IP address ?

2>You do not need bi directional option checked if you are only allowing users to access the Internet using Outside Interface IP.

3>Also check which rule it hits when you can successfully ping and compare it with non working security rule.

4>Use the test nat command

test nat-policy-match protocol 6 from L3-Trust to L3-Untrust source ip destination ip destination-port 443

Regards

Re: Internet Outage Occurs After Migration - All Packets Aging-out

PAN-Bariz2020 — Thu, 30 Jul 2020 20:07:39 GMT

Thank You.

I had performed those steps on the first failure and did not found any issue. I believe there might be a VRF issue from the ISP site. I will be able to get back on this next week.

Re: Internet Outage Occurs After Migration - All Packets Aging-out

MP18 — Thu, 30 Jul 2020 21:25:17 GMT

@PAN-Bariz2020

Thanks for the update.

Regards

Re: Internet Outage Occurs After Migration - All Packets Aging-out

PAN-Bariz2020 — Wed, 05 Aug 2020 00:14:27 GMT

Hi All,

It was nothing but ARP cache from the Service Provider side, There was another switch between the Palo Alto Networks Firewall and ISP router. The ARP cache that i was getting on the firewall was from the switch not from the actual ISP router. The issue immediately got fixed upon ARP cache clear.