Palo Alto unable to route traffic into LACP trunked subinterface vlans

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Palo Alto unable to route traffic into LACP trunked subinterface vlans

L0 Member

Hi,

I have an issue with routing traffic over to a new DMZ SW implementation. Hope someone can crack the nut.

Issue : Palo Alto unable to route traffic into LACP trunked sub-interface vlans in VRFs

1. Each switch VRF is a Zone on the PA.

2. All routes defined in respective VRs.

3. All VRFs default route is the respective vlan IP tagged at the subinterface of AE at firewall.

4. All objects created are shared between Vsys.

5. reason for vsys splitting is for easier visibility of rule-list based on zones functions.

 

What the set up is able to do now.

1. all vlans in AE.2 is able to ping the firewall and DMZ switch and vice versa

2. a client behind INT Firewall is able to ping/tracert all AE1.x and  AE2.x interfaces

3. traffic is able to pass from vys1-2 and back

4. traffic withing VRFs are able to reach each other.

 

What the set up is unable to do now.

1. all vlans in AE.1 is unable to ping the firewall and DMZ switch and vice versa

2. a client behind INT Firewall is able to ping all vlan gateways on the DMZ switch

3. traffic from vlans from DMZ switch do not reach the firewall.

 

2 REPLIES 2

Cyber Elite
Cyber Elite

since you created aggregates and are using all links for the same vlans, is there a specific reason you wentfor layer2 vs layer3?

 

 

did you add a management profile to all the vlan interface (l3) zones with ping enabled?

 

did you set up 'external' zones with visibility to each vsys, with routing entries to next VR and security policies from/to the 'external' zones ?

 

 

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

Hi Reaper,

since you created aggregates and are using all links for the same vlans, is there a specific reason you went for layer2 vs layer3?

BTC.pa : Yes, trying to keep the VRF-lite setup simpler and minimize hops vs. the layer 3 point to point.

 

did you add a management profile to all the vlan interface (l3) zones with ping enabled?

BTC.pa : yes done.

 

did you set up 'external' zones with visibility to each vsys, with routing entries to next VR and security policies from/to the 'external' zones ?

BTC.pa : Yes the external zones are able to pass traffic to one another.

 

PS : I think I found the root cause of the problem to be route not established in the DMZ switch back.
The global config has the "ip route vrf A 0.0.0.0 0.0.0.0 (AE.1x)"
But this is not reflected in the "sh ip route vrf A"

Trying to resolve this. IP routing is enabled on the switch. Able to route within VRF.

  • 2339 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!