Elastic IP's not responding on Palo Alto VM

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Elastic IP's not responding on Palo Alto VM

L1 Bithead

Greetings All,

 

I have a very basic question and basic issue.  I have Palo Alto up and running in my lab on AWS.  I can connect to the Management Interface just fine.  I have added eth1 to the the PA and configured the access for ping, ssh, https, etc. Also created the zone.  I am using the default virtual router. 

 

From within my VPC using another Linux instance I can ping the private IP address on eth1, but I cannot ping the elastic IP address that is associated with that eni from the internet.  I can ping the Management public address but not anything I add to eth1, eth2, etc.  I am just out of ideas!!

 

Any help would be really appreciated!

 

Greg

1 accepted solution

Accepted Solutions

Palo Alto Networks Guru

Hi Greg,


This should work and is supported.  I've done this myself with no issues.  Here are some things to try:

  • double check your AWS security group for that ENI
  • double check your subnet route
    • if this ENI is on a different subnet then the management ENI, does that other subnet have an IGW route?
  • SSH in and run the command: show counter global filter delta yes
    • then launch your ping to the EIP and repeat the command above
    • look for any drops
  • as a last resort, override your default inter and intra security policy rules and turn on start/stop logging
    • watch the traffic log

 

HTH,


Warby

View solution in original post

5 REPLIES 5

Palo Alto Networks Guru

Hi Greg,


This should work and is supported.  I've done this myself with no issues.  Here are some things to try:

  • double check your AWS security group for that ENI
  • double check your subnet route
    • if this ENI is on a different subnet then the management ENI, does that other subnet have an IGW route?
  • SSH in and run the command: show counter global filter delta yes
    • then launch your ping to the EIP and repeat the command above
    • look for any drops
  • as a last resort, override your default inter and intra security policy rules and turn on start/stop logging
    • watch the traffic log

 

HTH,


Warby

Thank you for the feedback.  Yes the ping is being denied according to the intrazone rule.  I have a management rule that allows ping set up and applied to that interface.  It should accept ping...

 

Thank you again!

Ok, well based on what you told me I think I may have been blocking myself!!  It is working now and I thank you for your response.  I learned some good troubleshooting along the way!!

 

Best Regards,

 

Greg

Hi Warby,

I have this similar issue with Paloalto external interface elastic ip not reachable from internet

but mgmt EIP is reachable

Verified security group allow all traffic & enabled https

Any idea?

 

Thanks

Manoj

L0 Member

Hi Manoj ,

 

Please check the security group assigned to the public interface . Make sure all the traffic from 0.0.0.0/0 is allowed on all ports initalially while testing.

  • 1 accepted solution
  • 5177 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!