Layer 3 routing on PA

Reply
Highlighted
L2 Linker

Layer 3 routing on PA

Guys, facing a small issue hope can resolve together

I have created a new network on PA as Layer-3(503) and am trying to communicate with my other existing layer-3 network (501):

Steps configured are as follows :

1) created Layer-3 ae4.503 with IP X.53.1 and existing is ae4.501 with IP X.50.1

2) Policy from both either network 

3) Policy based forwarding specific from 501 to 503; Pbf is configured to avoid route lookup

4) also Source NAT is created from 501 to 503

5) Access switch is configured with vlan and interface IP for both.

 

 when is try ping from access switch to PA ---- SUCCESS

Now i try ping from my PC which is in 501 vlan am unable---- NO SUCCESS

 

i see hit-counts increase on PA policy, pbf and sNAT; but ping from my PC is FAILING...

 

Help

 


Accepted Solutions
Highlighted
L2 Linker

Static routes are configured for traffic destined to DC-FW (or dmz traffic) and the new network which i made is for management of my external  facing devices. 

About snat config even i wasnt sure of as my source is 501 ip and destination is the interface ip on PA.

Anyways i tried to ping from 501 to 503 but am not getting ping responses i.e Fails

 

if i try ping on switch as:

ping x.x.53.1 source x.x.51.1-------- ping Success

 

On PA

ping source x.x.53.1 host x.x.51.1 ------- ping success

 

But on LAN PC no PING Responses.

View solution in original post


All Replies
Highlighted
L7 Applicator

@zaidshaikh 

 

why do you need to avoid route lookup?

your configurations is incredibly complex for and very simple topology, so i would like to understand

 

if you are pinging from your pc in vlan 501 to palo alto ip in vlan 503, you are most likely performing a land attack on yourself (source nat to the interface ip, while destination is also interface ip = illegal source + destination combination)

try pinging the remote vlan ip

Tom Piens - PANgurus.com
Find my book at amazon.com/dp/1789956374
Highlighted
L2 Linker

Static routes are configured for traffic destined to DC-FW (or dmz traffic) and the new network which i made is for management of my external  facing devices. 

About snat config even i wasnt sure of as my source is 501 ip and destination is the interface ip on PA.

Anyways i tried to ping from 501 to 503 but am not getting ping responses i.e Fails

 

if i try ping on switch as:

ping x.x.53.1 source x.x.51.1-------- ping Success

 

On PA

ping source x.x.53.1 host x.x.51.1 ------- ping success

 

But on LAN PC no PING Responses.

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!