Problems with routing two different LANs in the same interface
Showing results for 
Search instead for 
Did you mean: 

Problems with routing two different LANs in the same interface

L1 Bithead

I have this scenario:


Genesis Amazonas.png


My PA-200 have 2 interfaces: one connected to the Internet Zone, another to the LAN Zone. The LAN interface has as its IP address. I have another LAN connected through a router with IP address. 


In the PA-200, in the default-router I added the route for with gateway 


Ping works, traceroute too. But when I try remote desktop, HTTP, telnet (or any TCP) from to (or vice versa), cannot connect and get "time out" message


Both and are in the same zone. What is the cause I cannot make TCP connections between this 2 LANs?


I am using PANOS 7.0.3


Best Regards to everyone. 


L5 Sessionator

Asymmetric routing. I think traffic syn is going through PA and syn-ack is coming directy to device and then ack is going to PA and PA is dropping it. 


As a work around do a source NAT of the traffic to 1.1 for traffic coming from 1.100 goging to 2.100.

Thanks Pankaj...


Is it related? 


Best Regards!

Yes but instead of that you can try the workaround suggested by me.



please try configuring U-Turn NAT: How to Configure U-Turn NAT

Tom Piens
Like my answer? check out my book!

L4 Transporter

Apart from NAT, if possible, you can have static persistent routes on the hosts in segment to route traffic for via the router

I am not sure of the purpose of the router but can you also move the router and the segment as a new zone on PA-200.

Though technically possible, the firewall should not send traffic back from the same interface where it is received from.

Dear Reaper and Sly_Cooper,

I have a similar issue.  I have two LAN; LAN 1 IP is that is going to the internet and it is working fine to the internet.  The interfaces are eth1/1 as the wan eth1/2 as the lan the gateway is  From my laptop with ip internet is working.  From my laptop I need to connect to the other LAN.  The other LAN is connected to eth1/8 with IP  this lan gateway is  I am using two cables one goes to and the other cable goes to  But I wanted to be able to connect to the without have to change the cable every time. How can I creat a local vrouter to connect these two LANs together?


Thank you so much

Hi @rossghanim


How have you configured your firewall? if you added all interfaces to the same VR, this will work out-of-the-box


make sure your NAT rules are set to specific zones (trust to untrust,...) so you don't accidentally NAT inter-lan connections and make sure to set your security policies so the connections are allowed



Tom Piens
Like my answer? check out my book!

Dear reaper,

Thank you so much for your prompt reply.  I wanted to give you all my configuration:


The management int IP is and the default gateway is working 

eth1/1 layer 3 IP connect to ISP working

eth1/2 layer 3 IP connect through Internet_Gateway

vRouter: Internet_Gateway interfaces eth1/1 and 1/2:


Int eth1/1

next hop IP static route working


Internet: layer 3 eth1/1

Users: layer 3 eth1/2

Policies security:

bad-application-block: source zone users to dest zone internet

internet-access: source zone users to dest zone internet


outband-nat source users dest internet dest interface eth1/1 any any 

source translation: dynamic-ip-and-port ethernet1/1 working


Now I have another LAN that only I need access to no one else which has our windows server that I need to connect to to do backup and other RDP active directory.  The IP address is I confgiured interface eth1/8 layer3 with IP:

By the way this network is going through Cisco router to the internet which I confgiured already and working fine.


All I want is from my laptop with gateway to reach the server at and the server is


I tried few things but is still not working kinldy help me and send me documents where I can confgirue it myself.


By the way I already passed the PA ACE certificate.


Thank you so much






Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!