Palo Alto Intergrade with ACI- Cannot see hop firewall on tranceroute

[LeNgocTan]

I Integrade Firewall Palo Alto with ACI One Arm , virtual system divided into 2 for North South and East West

On Firewall config Subinterface Layer3 ( Vlan Tag) set IP and config default route to Gateway one ACI. (reference guide)

https://docs.paloaltonetworks.com/vm-series/10-2/vm-series-deployment/set-up-a-firewall-in-cisco-aci...

Traffic from ACI will use PBR to route through Palo Alto, and Palo Alto will return back to ACI using the default route

But when I check tracert between 2 host on traceroute table with traffic throught firewall, I can see all host except the Firewall host.

On the firewall I tried opening the policy allow any any, turning off Zone Protection, turning off Packet Buffer Protection but still can't see the firewall hop in the traceroute message. ping between 2 hosts works fine,

When I capture firewall, on TX i see firewall sent icmp ttl exeeded to client but destination MAC is 00:0c:0c:0c:0c:0c (anycast MAC of ACI) not MAC Address Of client in ARP table

Except for TTL Exceeded all other messages sent to the client are sent to the correct MAC address seen in the ARP.

also. when i test ping traceroute from host to firewall, ping and tracert are ok and with this traceroute i can see the host of firewall

Has anyone ever deployed Palo Alto firewall with ACI and tested tracert with packets passing through the firewall? Looking forward to sharing experiences.

Many tks

[reaper]

To be able to see the firewall in traceroute or ping, you need to set an interface management profile on both interfaces with 'ping' enabled

Next a rule needs to allow your hosts to communicate with the firewall interfaces (depends on how strictly you set your rulebase)