topic Re: Management profile issue in General Topics

Management profile issue

Satish — Wed, 19 Nov 2014 07:44:06 GMT

Hi Friends,

please suggest, i have create a management profile (ping,ssh,https ) and apply e1/1 (static ip) but i am not able to ping and web access.

Regards Satish

Re: Management profile issue

HULK — Wed, 19 Nov 2014 08:00:05 GMT

Hello Satish,

Do you have a "default deny" policy on this firewall, it may block interface management traffic ( intra zone traffic).

For an example: If you have enabled management profile (ping,ssh,https ) on ethernet-1/1 interface ( Trust zone) and you are trying to access the firewall from your Trust network, then you have to configure a "Trust to Trust" security policy on this firewall ( if you have a any-any-deny rule at the bottom).

Hope this helps.

Thanks

Re: Management profile issue

Satish — Wed, 19 Nov 2014 08:06:40 GMT

Hi Hulk,

I have already create a policy for the same like (trust to trust and wan to wan ) but facing same issue and also i am not getting any logs. please suggest.

Regards

Satish

Re: Management profile issue

HULK — Wed, 19 Nov 2014 08:18:21 GMT

Hello Satish,

Do you have multiple VR or VSYS on your setup...?

Thanks

Re: Management profile issue

Retired Member — Wed, 19 Nov 2014 08:21:32 GMT

hi,

best way look if paloalto drops that or not (ping with -t and start doing)

go to cli

debug dataplane packet-diag set filter match source SOURCEIP destination INTERFACEIP

debug dataplane packet-diag set filter match source INTERFACEIP destination SOURCEIP

debug dataplane packet-diag set filter on

show counter global filter packet-filter yes delta yes severity drop

output will show information

Re: Management profile issue

HULK — Wed, 19 Nov 2014 08:22:24 GMT

Hello Satish,

Do you have any NAT policy configured for the same interface IP address..?

Thanks

Re: Management profile issue

HULK — Wed, 19 Nov 2014 08:23:33 GMT

Unable to Connect to or Ping a Firewall Interface

mgmt

Thanks

Re: Management profile issue

Satish — Wed, 19 Nov 2014 09:12:04 GMT

Hi Hulk, No, i dont have multiple VR. Regards Satish

Re: Management profile issue

Satish — Wed, 19 Nov 2014 09:18:13 GMT

Hi Hulk,

yes i have NET policy for the same interface.

Regards

Satish

Re: Management profile issue

Retired Member — Wed, 19 Nov 2014 09:19:28 GMT

if you have a NAT rule with source zone any this can be the issue

Re: Management profile issue

Satish — Wed, 19 Nov 2014 09:44:44 GMT

Hi PANOS,

You are right after disable NAT rule. i am able to ping and SSH, HTTPS.

Regards

Satish

Re: Management profile issue

Satish — Wed, 19 Nov 2014 09:45:35 GMT

please suggest to me best practice for the same.

Re: Management profile issue

Retired Member — Wed, 19 Nov 2014 09:56:56 GMT

When using NAT rules do not use any,

instead use the real zone names related.

What is the rule disabled ? can you share