After upgradation no traffic flow between DMZ to WAN

[ChandrashekharD]

Hi Team,

I hope you are doing well.

One of our customers is attempting to upgrade their PAN-OS version from 11.0.4-h1 to a higher version, as the 11.0 version is nearing its end-of-life.

The issue encountered is that whenever we upgrade beyond version 11.0.4-h1, communication between the DMZ and WAN zones is lost. Specifically, after the upgrade, inbound traffic does not reach the firewall. However, after downgrading back to 11.0.4-h1, we observed that traffic from the WAN network correctly reached the servers as expected.

Below are our failed upgrade attempts:

From PAN-OS 11.0.2-h2 to PAN-OS 11.1.0: No incoming traffic after upgrade.
From PAN-OS 11.0.4-h1 to PAN-OS 11.1.2-h3: No incoming traffic after upgrade.
From PAN-OS 11.0.4-h1 to PAN-OS 11.0.5: No incoming traffic after upgrade.

In each of these attempts, it was observed that only the devices in the DMZ were impacted, experiencing a complete loss of both incoming and outgoing traffic.

Versions with failed upgrade attempts include:

PAN-OS 11.1.0
PAN-OS 11.1.2-h3
PAN-OS 11.0.5
PAN-OS 11.1.4-h1
PAN-OS 11.1.2-h9

Please suggest a preferred and stable version for the upgrade that will not affect traffic between the zones.

Regards,

Chandrashekhar

[BPry]

@ChandrashekharD,

It kind of sounds like your just running into an ARP issue for your NAT addresses? Do you either have a static route that would be required to route this traffic properly or a secondary address configured for each address on your untrust interface?