Access PA-440 MGMT Interface via Cisco Switch

[Janmejay_Dave]

Hi Guys,

I am working with below scenario and would like some help.

As shown in diagram:

A cisco switch IE3400 is connected with PA-440 with trunk connection and also one of the interface of switch is connected to MGMT port of PA-440.

There are multiple VLANs in the network but I showed only the relevant in this case.

Cisco Switch has Vlan 103 ip address 192.168.1.166 and gateway is 192.168.1.161 which is the IP address of Vlan subinterface of PA-440.

PA-440 MGMT port has IP 192.168.1.173/28 and G/W 192.168.1.161.

I am trying to access the MGMT port from my laptop having IP address (VLAN 110) 192.168.1.254 and G/W 192.168.1.253 which is the IP of subinterface Vlan 110 of PA-440.

From my laptop. I can ping the 192.168.1.166, 192.168.1.161 and 192.168.1.253 but I can not ping 192.168.1.173.

I configured SPAN at the interface connecting to Switch to PA-440 and I can see in WireShark that the ping request going to MGMT port but it is not responding back.

I am pretty sure that it is something to do with PA-440 and not Cisco.

Does anyone has any idea why it is happening?

Is it even possible to do this way?

Is the issue the same Vlan on MGMT and on Interface level, where the default gateway of MGMT port is same as the IP address of Vlan 103 subinterface in PA-440?

Regards,

[seb_rupik]

Hi there,

What does the mac address table and IP ARP table look like on the switch for VLAN 103 ? Do the details of the Palo Alto MGMT interface appear? Likewise, what does the ARP table on the firewall look like (show arp management), can you see the details for the PA VLAN103 sub-interface? What can you ping from the management interface?

Finally, does the management interface have an Allowed IP list configured?

cheers,

Seb.