Elastic IP's not responding on Palo Alto VM

L1 Bithead

Elastic IP's not responding on Palo Alto VM

Greetings All,


I have a very basic question and basic issue.  I have Palo Alto up and running in my lab on AWS.  I can connect to the Management Interface just fine.  I have added eth1 to the the PA and configured the access for ping, ssh, https, etc. Also created the zone.  I am using the default virtual router. 


From within my VPC using another Linux instance I can ping the private IP address on eth1, but I cannot ping the elastic IP address that is associated with that eni from the internet.  I can ping the Management public address but not anything I add to eth1, eth2, etc.  I am just out of ideas!!


Any help would be really appreciated!



Palo Alto Networks Guru

Re: Elastic IP's not responding on Palo Alto VM

Hi Greg,

This should work and is supported.  I've done this myself with no issues.  Here are some things to try:

  • double check your AWS security group for that ENI
  • double check your subnet route
    • if this ENI is on a different subnet then the management ENI, does that other subnet have an IGW route?
  • SSH in and run the command: show counter global filter delta yes
    • then launch your ping to the EIP and repeat the command above
    • look for any drops
  • as a last resort, override your default inter and intra security policy rules and turn on start/stop logging
    • watch the traffic log




L1 Bithead

Re: Elastic IP's not responding on Palo Alto VM

Thank you for the feedback.  Yes the ping is being denied according to the intrazone rule.  I have a management rule that allows ping set up and applied to that interface.  It should accept ping...


Thank you again!

L1 Bithead

Re: Elastic IP's not responding on Palo Alto VM

Ok, well based on what you told me I think I may have been blocking myself!!  It is working now and I thank you for your response.  I learned some good troubleshooting along the way!!


Best Regards,



Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!