Palo Alto unable to route traffic into LACP trunked subinterface vlans

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L0 Member

Palo Alto unable to route traffic into LACP trunked subinterface vlans

Hi,

I have an issue with routing traffic over to a new DMZ SW implementation. Hope someone can crack the nut.

Issue : Palo Alto unable to route traffic into LACP trunked sub-interface vlans in VRFs

1. Each switch VRF is a Zone on the PA.

2. All routes defined in respective VRs.

3. All VRFs default route is the respective vlan IP tagged at the subinterface of AE at firewall.

4. All objects created are shared between Vsys.

5. reason for vsys splitting is for easier visibility of rule-list based on zones functions.

 

What the set up is able to do now.

1. all vlans in AE.2 is able to ping the firewall and DMZ switch and vice versa

2. a client behind INT Firewall is able to ping/tracert all AE1.x and  AE2.x interfaces

3. traffic is able to pass from vys1-2 and back

4. traffic withing VRFs are able to reach each other.

 

What the set up is unable to do now.

1. all vlans in AE.1 is unable to ping the firewall and DMZ switch and vice versa

2. a client behind INT Firewall is able to ping all vlan gateways on the DMZ switch

3. traffic from vlans from DMZ switch do not reach the firewall.

 

Highlighted
L7 Applicator

since you created aggregates and are using all links for the same vlans, is there a specific reason you wentfor layer2 vs layer3?

 

 

did you add a management profile to all the vlan interface (l3) zones with ping enabled?

 

did you set up 'external' zones with visibility to each vsys, with routing entries to next VR and security policies from/to the 'external' zones ?

 

 

Tom Piens - PANgurus.com
New to PAN-OS or getting ready to take the PCNSE? check out amazon.com/dp/1789956374
Highlighted
L0 Member

Hi Reaper,

since you created aggregates and are using all links for the same vlans, is there a specific reason you went for layer2 vs layer3?

BTC.pa : Yes, trying to keep the VRF-lite setup simpler and minimize hops vs. the layer 3 point to point.

 

did you add a management profile to all the vlan interface (l3) zones with ping enabled?

BTC.pa : yes done.

 

did you set up 'external' zones with visibility to each vsys, with routing entries to next VR and security policies from/to the 'external' zones ?

BTC.pa : Yes the external zones are able to pass traffic to one another.

 

PS : I think I found the root cause of the problem to be route not established in the DMZ switch back.
The global config has the "ip route vrf A 0.0.0.0 0.0.0.0 (AE.1x)"
But this is not reflected in the "sh ip route vrf A"

Trying to resolve this. IP routing is enabled on the switch. Able to route within VRF.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!