Incomplete ARP when deployed in Azure

[vravindra]

Hello,

I deployed NGFW 8.1 using Terraform (v0.11.36) in Azure. It provisions VM and all the resources like resource group, VNet, subnet, IP's etc., But the only problem is with the UnTrust(eth1/1) NIC as it complains 'Incomplete ARP even after configuring the Interfaces and the static routes in Virtual router page. I only get this problem when I do it using Terraform and not using the Azure's solution template or ARM templates.

Did anyone had the same issue? and can I know how was it resolved? thanks in advance.

Regards,
Vishnu

[BPry]

@vravindra,

This can be a large number of things, without additonal insight into how you have things configured saying exactly what it is isn't going to be possible. I personally would be reaching out to TAC so that someone can actually look at how a firewall you are deploying is actually configured. A few things to check though:

• The firewall has corresponding routes for all subnets pointing to the first IP of the subnet the firewall is attached to.
• Ensure the interface itself has IP Forwarding enabled on the Azure side of things when configured through terraform. 
• The UDR is being properly assigned to the subnets. 

[vravindra]

Hello @BPry 

Thanks for responding, appreciate it.

My issue is the basic NGFW deployment using the 'PAYG' azure marketplace. This is only for evaluation/PoC. 

I compared the templates of the NGFW for both the deployments using Terraform and the Azure solution template, it is similar but not sure why the untrust nic complains for ARP. I did contact the Palo Alto support but since they don't officially support the Terraform, it did not get solved.

I can share with you the Terraform file if you would like to look at it and give me some comments.

Regards,
Vishnu

[ashleyk]

Hello,

Im completely deployed via terraform. Azurerm for the virtual machine and panos for configuration.

Check out my post here
https://live.paloaltonetworks.com/t5/general-topics/azure-palo-alto-arp-not-found/m-p/336411/thread-...

I think it might help you out.

Thanks