Cisco Guest Mobility Anchor Controller Tunnels are down when placed behind Palo Alto firewall

[shabeeb]

Hi,

I have a pair of Cisco controllers setup as mobility anchor controllers,  which will basically initiate EoIP tunnel between them. Recently we have placed a Palo Alto 5250 firewalls between the controllers through virtual wire interfaces. The physical connectivity is as follows

Cisco Controller 1 ----> Palo Alto VWire-IN -------> Palo Alto VWire-Out -----> Cisco Controller 2

The issue is that after placing the Palo Alto firewall , the tunnel between the controllers is not coming up. I have all allowed the traffic in both directions. There is no rule blocking the traffic. Please let me know if anyone had the similar issue.

Thanks 

Shabeeb

[BPry]

@shabeeb,

I would wireshark both ends and look and see if the Palo is manipulating the packets in some way. That's about the only thing I can think of that would be breaking this. 

@tac.in makes a really good point; you are allowing the traffic with service and application set to 'any' right? I always assume that in a v-wire configuration that is how the rule is built, however that is sometimes something that people can run into. 

[tac.in]

Hi Shabeeb,

Please try changing service from application-defaults to any. The tunnel might be on other ports other than default ports .

[shabeeb · Accepted solution]

Hi All,

The issue was that the vlans were not allowed in the virtual wire. Once I allowed the vlans everything worked fine. Thanks for the valuable replies guys.