Management profile issue

[Satish]

Hi Friends,

please suggest, i have create a management profile (ping,ssh,https ) and apply e1/1 (static ip) but i am not able to ping and web access.

Regards Satish

[HULK]

Hello Satish,

Do you have a "default deny" policy on this firewall, it may block interface management traffic ( intra zone traffic).

For an example: If you have enabled management profile (ping,ssh,https ) on ethernet-1/1 interface ( Trust zone) and you are trying to access the firewall from your Trust network, then you have to configure a "Trust to Trust" security policy on this firewall ( if you have a any-any-deny rule at the bottom).

Hope this helps.

Thanks

[Satish]

Hi Hulk,

I have already  create a policy for the same like (trust to trust and wan to wan ) but facing same issue and also i am not getting any logs. please suggest.

Regards

Satish

[HULK]

Hello Satish,

Do you have multiple VR or VSYS on your setup...?

Thanks

[panos]

hi,

best way look if paloalto drops that or not (ping with -t and start doing)

go to cli

debug dataplane packet-diag set filter match source SOURCEIP destination INTERFACEIP

debug dataplane packet-diag set filter match source INTERFACEIP destination SOURCEIP

debug dataplane packet-diag set filter on

show counter global filter packet-filter yes delta yes severity drop

output will show information

[HULK]

Hello Satish,

Do you have any NAT policy configured for the same interface IP address..?

Thanks

[HULK]

Unable to Connect to or Ping a Firewall Interface

mgmt

Thanks

[Satish]

Hi Hulk, No, i dont have multiple VR. Regards Satish

[Satish]

Hi Hulk,

yes i have NET policy for the same interface.

Regards

Satish

[panos · Accepted solution]

if you have a NAT rule with source zone any this can be the issue

[Satish]

Hi PANOS,

You are right after disable NAT rule. i am able to ping and SSH, HTTPS.

Regards

Satish

[Satish]

please suggest to me best practice for the same.

[panos]

When using NAT rules do not use any,

instead use the real zone names related.

What is the rule disabled ? can you share