06-23-2023 07:20 AM - edited 06-23-2023 07:22 AM
Needing a little help. I have a PA 5220 within a secure enclave (so no connection to the internet). I can ping a gateway in another enclave without any issue but when I ping the network beyond that gateway I get no reply. My GW external interface and their GW external interface are on the same subnet and their internal network and my internal network are on the same subnet but a different subnet than what is on the external interfaces. I can ping their external GW from both my external and my internal interface but nothing beyond it. They have confirmed that the device that I am pinging in question is open to reply to everyone. The crazy thing is that when I ping anything within their internal network I get no response and the traffic capture on the switch (which sits between the 2 GWs) shows no traffic coming from my side whatsoever. So it seems like the ping is dying before it ever leaves the firewall. The traffic log shows "aged-out" and packet capture I run shows no response found. Also, currently for testing I have a route in the virtual router for quad zeroes (0.0.0.0/0). Again when I ping their GW I get a response but not anything from their internal (which is the same range as my internal NW) Any help would be appreciated!
06-23-2023 09:42 AM
Hello,
For the enclave, verify you have routes in the virtual router. Also check the logs to see where/if the traffic is being denied. I usually put my enclaves into a different zone so security policies are the only way the traffic is allowed in/out.
Regards,
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
