Cannot ping connected adsl modem.

[Oseberg]

Hi all,

i've connected a adsl modem to our 3020 to redirect some clients to,  configured the interface as dhcp client, the port successfully gets an ip address from the modem but i can not ping the modem interface from firewall's cli. I might be missing a simple step but i'm fairly new with PA, any help appreciated, thank you

[ansharma]

Hi Oseberg,

Welcome to the community forums!

Create an interface management profile, tick the 'Ping' box and add it to the interface eth 1/5.

Hopefully that should take care of it. 

Regards,

Anurag

[Oseberg]

Sorry for not mentioning but i've already created a management profile with ping, ssh, telnet and http, and attached it to eth5

[TranceforLife · Accepted solution]

Hi,

MGMT profiles will work but only for traffic directed to the Palo interface. If you are initiating the traffic from the Palo ping should work (so no MGMT profiles required). ADSL modem simply might not reply for pings. Are you able to access the internet over that link? You can test with this command:

> ping source 192.168.2.10 host 8.8.8.8

[TheRealDiz]

Exactly @TranceforLife,

As tranceforlife told you.. When you ping via CLI from a PA firewall you have to type "ping source <ip related to the interface> host <ip dst>" . If you don't put the keyword "source" you will start ping (by default) from the management interface!

BR

D!Z

[Oseberg]

Thank you for the advice.

i cannot ping from source 192.168.2.1 i get an "bind: cannot assign requested address" error

But i can ping google dns from source 192.168.2.10

So is it working as it should ?

[TranceforLife]

Sorry l had a typo. You need to source from your assigned ip address by ADSL modem 192.168.2.10

[reaper]

---

@Oseberg wrote:

Sorry for not mentioning but i've already created a management profile with ping, ssh, telnet and http, and attached it to eth5

---

First off: please don't attach this profile to your WAN interface, especially telnet and http are bad ideas to expose to the internet (they expose your management interface to the whole wide internet, unless you set strict security profiles)

I'd recommend setting up GlobalProtect for management tasks

You may need to create a specific NAT rule at the top of your NAT policy to not apply nat for any traffic from trust to untrust destined to your external IP as this may create a LAND attack

Typically your default NAT rule will hide trust ip subnet behind the untrust interface IP, for any internet bound traffic this is perfect. but when connecting directly to your external interface, your source ip (natted) wil match your destination ip (interface) exactly. This is called a LAND attack (typically an attacker will use source spoofing to force your interface to reply to itself, potentially causing a loop). Hence, any packets destined to an interface sourced from the same IP address will be dropped

for your ping this will mean it will be discarded as well

For a dynamic interface this could pose a challenge as you won't know what your IP will be in advance: you could create a policy on the spot or use a dynamic dns and set an FQDN

[Oseberg]

thanks reaper, but i was just doing couple of tests from this wan, only ping will be open after all,

Thanks all, for the advices