PA3050 cant ping next hop and has dropped all client traffic heading outbound.

[lschs-s]

I have tried a lot, and at this point I think I just must be missing something obvious that for whatever reason wont come to mind. From the PA3050 I can not ping outbound from the public IP. When I run captures, all outbound traffic is in dropped stage. There is no network functionality at all, and I am unable to find the issue.

Security ConfigNAT Config

[Raido_Rattameister]

Have you enabled LACP on ae.x interface in Palo?

[lschs-s]

Yes and on both routers both links are active and LACP established the bond. Like I said, the issue was happening before the AE, so I doubt it has any influence on my issues here.

[lschs-s]

Did the test as you recomended, disabled LACP and did a direct L3 on the Palo Alto to my laptop. No client packets or pings from source 67.107.166.142 made it outbound. Its like the firewall isnt routing or has some setting blocking it from talking.

[Raido_Rattameister]

debug dataplane packet-diag set filter off
debug dataplane packet-diag clear filter all

debug dataplane packet-diag set filter match source 67.107.166.142
debug dataplane packet-diag set filter match destination 67.107.166.142

debug dataplane packet-diag set filter on

show counter global filter delta yes packet-filter yes

ping source 67.107.166.142 host <ip of your laptop>

show counter global filter delta yes packet-filter yes

Now post here output of the last show counter global result.

And then to clean up:

debug dataplane packet-diag set filter off
debug dataplane packet-diag clear filter all

[lschs-s · Accepted solution]

Thank you so much for the help, but I fixed it all! It was some issues with subnetting and a few with routing, but worked them all out. I would go in detail, but it was in no way related to nat or security.