Palo Alto interface does not ping after a certain period of time

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Palo Alto interface does not ping after a certain period of time

L0 Member

We are running NMS.

However, the operation method does not work internally and goes out to the VPN public IP.

trust -> untrust -> isp(internet outside) -> VPN untrust

Communication is done in the same way as above. In NMS, the status of VPN untrust is monitored by ICMP.

However, after 30 minutes, the VPN untrust interface suddenly stops pinging.

The workaround is to send a ping command to VPN untrust -> VPN ISP using source ip, then NMS can send ping normally again.

I don't know why the ping keeps dropping every 30 minutes.

We are experiencing a VPN stoppage every 30 minutes.

help !!!!!!!!!!!!!!!!!!~~~~~~~~~~~~

2 REPLIES 2

Cyber Elite
Cyber Elite

If I understand the question (from my perspective) It sounds to me that the the ARP entry for the MAC address of the ISP is being removed from the FW (this is OK and common.. .all devices have an ARP timeout setting).  My next question will be.. why does your ISP not provide its mac address?  When you need to ping with the SrcIP, you are updating the FW's arp table again, to associate the L3 address to its L2 mac address. 

 

Consider that I ask for your home address, and you do not give it to me.. why would that be my issue?

 

Even though we talk about IP networks, please remember there is an OSI model, so L3 address go down the "stack" on an interface, and send L2 mac address to other device...   I think there is an issue, but not with the FW.  If the ISP does not provide its mac address, why would this be a FW issue? 

 

Now, you may need to modify your interface to add in a static mac address entry for your ISP.

 

Again, this is all how I have understood/perceived your issue.  If it is something else, or you can provide additional details, please advise.

 

Help the community: Like helpful comments and mark solutions

As you said, after a long time, I checked with show arp all in Palo Alto.

The arp table was gone. I don't understand.

The green LED is still on in the interface part.

why? Why can't arp be updated?

  • 2094 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!