Cannot ping server but monitor sees the ping traffic as allow

Reply
L2 Linker

Cannot ping server but monitor sees the ping traffic as allow

My Palo Alto PA200 e1/1 (10.10.10.1/30) is connected to router A and e1/2 (10.10.20.2/30) is connected to router B.

The server 192.168.1.100/24 is behind router A (10.10.10.2) which has a static router to destination 172.16.1.0/24 with next hop 10.10.10.1.

The user 172.16.1.100/24 is behind router B (10.10.20.1) which has a static router to destination 192.168.1.0/24 with next hop 10.10.20.2.

 

On my PA, I have static routes and policy below:

- destination 172.16.1.0/24 next hop 10.10.20.1 (Router B) via interface e1/2

- destination 192.168.1.0/24 next hop 10.10.10.2 (Router A) via interface e1/1

- policy allow source-address ZONE-ROUTER-A source-address 172.16.1.0/24  destination-zone ZONE-ROUTER-B destination-address 192.168.1.100 with any apps and services, 

 

 

It looks like I have a routing between the 2 subnets from my PA FW.

My FW can ping 192.168.1.100 sourcing 10.10.10.1 and 172.16.1.100 sourcing 10.10.20.2.

But I cannot ping 192.168.1.100 sourcing 10.10.20.2 and 172.16.1.100 sourcing 10.10.10.1. The strange thing is I can see the pings going through from the MONITOR on my PA200 when 172.16.1.100 tries to ping 192.168.1.100. But the ping from the user says failed.

 

Any inputs will be greatly appreciated. Thx

 

Am I missing a policy? 

Community Manager

Re: Cannot ping server but monitor sees the ping traffic as allow

the source and destination subnet of your security policy do not match your source and destination zones

 

- policy allow source-address ZONE-ROUTER-A source-address 172.16.1.0/24  destination-zone ZONE-ROUTER-B destination-address 192.168.1.100 with any apps and services, 

 

router A hosts 192.168.1.0/24 and router B hosts 172.16.1.100

 

to be able to ping 192.168.1.100 from 10.10.20.2 you will need additional security policy (from zone-router-B to zone-router-A)

to be able to ping 172.16.1.100 from 10.10.10.1 you will need additonal policy/expand the existing policy as the source subnet is not accounted for in your existing policy

 

 


Help the community: Like helpful comments and mark solutions
Reaper out
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!