1. All the units in above diagram are AWS EC2s. Pinging from Ubuntu10_20_61_16
to Ubuntu10_60_0_100 failed due to echo reply dropped on PA-VM.
admin@PA-VM> show counter global filter packet-filter yes delta yes severity drop
Global counters:
Elapsed time since last sampling: 1.16 seconds
name value rate severity category aspect description
--------------------------------------------------------------------------------
flow_fwd_zonechange 1 0 drop flow forward Packets dropped: forwarded to different zone
--------------------------------------------------------------------------------
Total counters shown: 1
2. Following is the routing info.
admin@PA-VM> show routing route
flags: A:active, ?:loose, C:connect, H:host, S:static, ~:internal, R:rip, O:ospf, B:bgp,
Oi:ospf intra-area, Oo:ospf inter-area, O1:ospf ext-type-1, O2:ospf ext-type-2, E:ecmp, M:multicast
VIRTUAL ROUTER: vr1 (id 1)
==========
destination nexthop metric flags age interface next-AS
0.0.0.0/0 10.20.10.1 10 A S ethernet1/1
10.20.10.0/24 10.20.10.50 0 A C ethernet1/1
10.20.10.50/32 0.0.0.0 0 A H
10.20.61.0/24 10.20.61.195 0 A C ethernet1/2
10.20.61.195/32 0.0.0.0 0 A H
10.60.0.0/24 0.0.0.0 10 A S tunnel.1
total routes shown: 6
3. Following is the Zones info
4. Following is the security policies info.
5. From the log below, we can see when ping from 10.20.61.16 to 10.60.0.100. it is from Pub-zone to VPN zone. ping packet goes from e1/2 to e1/1, then e1/1 goes to tunnel.1. But seems ping reply didn't take path, tunnel.1-->e1/1--->e1/2.
admin@PA-VM> test routing fib-lookup ip 10.20.61.16 virtual-router vr1
--------------------------------------------------------------------------------
runtime route lookup
--------------------------------------------------------------------------------
virtual-router: vr1
destination: 10.20.61.16
result:
interface ethernet1/2, source 10.20.61.195
--------------------------------------------------------------------------------
6. Guess ping reply didn't go the right path. So got "Packets dropped: forwarded to different zone".
7. There is no NAT rules on PA-VM.
How to fix this issue? Thanks for sharing your thoughts!
This the first topology previous post didn't show correctly.
