02-01-2023 06:21 AM
Hello everyone. I am new to Palo Alto firewalls. We have bought many new PA-440's and I am having trouble with my very first installation.
I have a site that is currently using a TP-Link AX1500 router.
Very simple setup.... ISPmodem----WANportOfAX1500/LANportOfAX1500----Clients.
I have tried, without success, to mimic the setup of the AX1500 and replace it with the PA-440. I have the PA-440 acting as a DHCP server. My clients get IP addresses, and then can ping the PA-440. They cannot ping anything on the Internet. From the PA-440 command line, I also cannot ping anything on the Internet (ping host 126.96.36.199 for example).
I know this post leaves many questions, but is there a guide on a very basic setup like this? I am sure I am missing something small but have been unable to put my finger on it.
Thank you -- Walter
02-01-2023 06:32 AM - edited 02-01-2023 06:32 AM
"ping host 188.8.131.52" sends ping requests out from Palo mgmt interface.
For this to work mgmt interface needs to be connected, NAT and security policy need to be in place.
Do you see those sessions under "Monitor > Traffic"?
By default "interzone-default" and "intrazone-default" rules don't log so it is suggested to override them and check "Log at session end" on Actions tab.
You can also try "ping source 184.108.40.206 host 220.127.116.11" (replace 18.104.22.168 with your WAN IP).
In this case ping goes out from WAN interface. NAT is not needed and by default "intrazone-default" rule will permit this traffic.
If you share output of your results we can help you get them connected.
02-02-2023 01:32 PM
Thank you very much for responding.
I am now working on the bench in my office. I have two Windows laptops, one Windows PC, and the Palo.
I have attached a picture of the connections.
I am sure I am missing something fundamental.
02-02-2023 06:07 PM - edited 02-02-2023 06:09 PM
Can you share screenshot of security and nat policy?
Have you permitted incoming ping in laptops (or disabled firewall)?
02-03-2023 06:28 AM
I have the Windows firewall disabled on both laptops. Just to make sure of pingability, I changed one laptop to match the subnet of the other laptop, cross-connected them via Ethernet, and they were able to ping each other.
I am attaching 7 screenshots. Thanks again for your help.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!