Interface question

[Morneweg]

Hi!

This is our network:

My question is about interface 1/6:

I can ping the juniper from outside the network. But I can only ping the OpenVPN Server if I configure the IP-Address 80.0.0.5/32 explicit in this interface. Without this entry (80.0.0.5/32) I can't ping this server... why 🙂 !?

[Raido_Rattameister]

What command do you use to ping?

If you don't specify source then your ping requests go out from mgmt ip.

Do I get it right that your OpenVPN has 80.0.0.5 ip set already.

If you configure same ip on Palo then you get response from Palo's own 80.0.0.5 ip not from OpenVPN.

You can check arp table to identify it by MAC address

show arp all

show arp ethernet1/6

Instead use command

ping source 80.0.0.1 host 80.0.0.5

[Morneweg]

Hi!

Yes - IP OpenVPN Server = 80.0.0.5 (eth1)

I have test "ping" from outside - http://ping.eu/

Without this entry (80.0.0.5 interface 1/6) I can't ping this IP...

But  I can ping 80.0.0.1 (the juniper ip) without an extra entry like 80.0.0.1/32 in interface 1/6

[Raido_Rattameister]

Is firewall in virtual wire mode?

If in layer 3 mode then do you have nat rule in place?

Can you paste screenshot of traffic log entry (click on magn glass on left)