Palo Alto unable to route traffic into LACP trunked subinterface vlans

[BTC.pa]

Hi,

I have an issue with routing traffic over to a new DMZ SW implementation. Hope someone can crack the nut.

Issue : Palo Alto unable to route traffic into LACP trunked sub-interface vlans in VRFs

1. Each switch VRF is a Zone on the PA.

2. All routes defined in respective VRs.

3. All VRFs default route is the respective vlan IP tagged at the subinterface of AE at firewall.

4. All objects created are shared between Vsys.

5. reason for vsys splitting is for easier visibility of rule-list based on zones functions.

What the set up is able to do now.

1. all vlans in AE.2 is able to ping the firewall and DMZ switch and vice versa

2. a client behind INT Firewall is able to ping/tracert all AE1.x and  AE2.x interfaces

3. traffic is able to pass from vys1-2 and back

4. traffic withing VRFs are able to reach each other.

What the set up is unable to do now.

1. all vlans in AE.1 is unable to ping the firewall and DMZ switch and vice versa

2. a client behind INT Firewall is able to ping all vlan gateways on the DMZ switch

3. traffic from vlans from DMZ switch do not reach the firewall.

[reaper]

since you created aggregates and are using all links for the same vlans, is there a specific reason you wentfor layer2 vs layer3?

did you add a management profile to all the vlan interface (l3) zones with ping enabled?

did you set up 'external' zones with visibility to each vsys, with routing entries to next VR and security policies from/to the 'external' zones ?

[BTC.pa]

Hi Reaper,

since you created aggregates and are using all links for the same vlans, is there a specific reason you went for layer2 vs layer3?

BTC.pa : Yes, trying to keep the VRF-lite setup simpler and minimize hops vs. the layer 3 point to point.

did you add a management profile to all the vlan interface (l3) zones with ping enabled?

BTC.pa : yes done.

did you set up 'external' zones with visibility to each vsys, with routing entries to next VR and security policies from/to the 'external' zones ?

BTC.pa : Yes the external zones are able to pass traffic to one another.

PS : I think I found the root cause of the problem to be route not established in the DMZ switch back.
The global config has the "ip route vrf A 0.0.0.0 0.0.0.0 (AE.1x)"
But this is not reflected in the "sh ip route vrf A"

Trying to resolve this. IP routing is enabled on the switch. Able to route within VRF.