Ping Packets dropped: forwarded to different zone

Susan_Avxt — Thu, 17 Dec 2020 07:31:31 GMT

1. All the units in above diagram are AWS EC2s. Pinging from Ubuntu10_20_61_16

to Ubuntu10_60_0_100 failed due to echo reply dropped on PA-VM.

admin@PA-VM> show counter global filter packet-filter yes delta yes severity drop

Global counters:

Elapsed time since last sampling: 1.16 seconds

name value rate severity category aspect description

--------------------------------------------------------------------------------

flow_fwd_zonechange 1 0 drop flow forward Packets dropped: forwarded to different zone

--------------------------------------------------------------------------------

Total counters shown: 1

2. Following is the routing info.

admin@PA-VM> show routing route

flags: A:active, ?:loose, C:connect, H:host, S:static, ~:internal, R:rip, O:ospf, B:bgp,

Oi:ospf intra-area, Oo:ospf inter-area, O1:ospf ext-type-1, O2:ospf ext-type-2, E:ecmp, M:multicast

VIRTUAL ROUTER: vr1 (id 1)

==========

destination nexthop metric flags age interface next-AS

0.0.0.0/0 10.20.10.1 10 A S ethernet1/1

10.20.10.0/24 10.20.10.50 0 A C ethernet1/1

10.20.10.50/32 0.0.0.0 0 A H

10.20.61.0/24 10.20.61.195 0 A C ethernet1/2

10.20.61.195/32 0.0.0.0 0 A H

10.60.0.0/24 0.0.0.0 10 A S tunnel.1

total routes shown: 6

3. Following is the Zones info

4. Following is the security policies info.

5. From the log below, we can see when ping from 10.20.61.16 to 10.60.0.100. it is from Pub-zone to VPN zone. ping packet goes from e1/2 to e1/1, then e1/1 goes to tunnel.1. But seems ping reply didn't take path, tunnel.1-->e1/1--->e1/2.

admin@PA-VM> test routing fib-lookup ip 10.20.61.16 virtual-router vr1

--------------------------------------------------------------------------------
runtime route lookup
--------------------------------------------------------------------------------
virtual-router: vr1
destination: 10.20.61.16
result:
interface ethernet1/2, source 10.20.61.195
--------------------------------------------------------------------------------

6. Guess ping reply didn't go the right path. So got "Packets dropped: forwarded to different zone".

7. There is no NAT rules on PA-VM.

How to fix this issue? Thanks for sharing your thoughts!

Re: Ping Packets dropped: forwarded to different zone

Susan_Avxt — Thu, 17 Dec 2020 07:33:55 GMT

This the first topology previous post didn't show correctly.

topic Re: Ping Packets dropped: forwarded to different zone in General Topics

Ping Packets dropped: forwarded to different zone

Re: Ping Packets dropped: forwarded to different zone