topic Re: Cannot ping ethernet1/1 in PA_VM in General Topics

Cannot ping ethernet1/1 in PA_VM

PAFrank — Sun, 25 Apr 2021 18:07:35 GMT

PA_VM installed in ESXi. PortGroup1 is connected to PA management interface. and Portgroup2 is connected to ethernet1/1. PC1 in Portgroup1 can ping the PA and visit it via GUI using management interface 10.0.10.16. Security zone is setup for ethernet1/1 with ip address 10.0.20.16. PC2 with ip address 10.0.20.10 is connected to Portgroup2, but the PC2 cannot ping ethernet1/1(10.0.20.16). Did I miss some steps? Thank you

Re: Cannot ping ethernet1/1 in PA_VM

nikoolayy1 — Mon, 26 Apr 2021 07:06:41 GMT

Check if you have "promiscuous mode is enabled " for portgroup or you have configured the ESXi mac address (read the below article):

https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/set-up-a-vm-series-firewall-on-an-esxi-server/troubleshoot-esxi-deployments/connectivity-issues/why-is-the-vm-series-firewall-not-receiving-any-network-traffic.html

Also after that if there are still issues do policy trace to see if the policy trace to confirm that the security policy allows you:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClQSCA0

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cla1CAC

If the policy allows you and there are still issues, do pcap capture to see if the traffic reaches the firewall at all:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClTJCA0

Re: Cannot ping ethernet1/1 in PA_VM

RamprakashRT — Mon, 26 Apr 2021 10:42:04 GMT

hi @PAFrank

Have you configured the management access profile .

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGdCAK

Thanks,

Ram