Routing driving me crazy

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Routing driving me crazy

L3 Networker

Hi folks,


here's a weird issue!

We have one public IP lets say

Our PA VM 300, can ping to any public IP address other than

For all other public IP addresses, it sends traffic via default route out of external interface. But for, it sends the traffic to our management gateway. Following to be noted:

1. is our other PA firewall external IP where we were trying to connect using IPSec S2S tunnel. I deleted all the tunnel config since I was afraid that it was somehow interfering with the routing. But that did not solve the problem.


2. From all other devices we can ping and ping is allowed on this interface.


3. Security Policies, NAT and static default route pointing out from external interface to next hop are all correct.


4. We can ping other public IP addresses like and even FQDNs like but only traffic to is routed through management interface.,


Any ideas anyone?

1 accepted solution

Accepted Solutions


Everything was configured correctly.

You know what solved the problem?? - Firewall Restart 😐

View solution in original post


L3 Networker



we tried using


ping host

ping source <our_public_interface_addr> host


No luck using both!



Whenever you try to ping an IP from firewall, by default it will use your mgmt plane and then will forward traffic to gateway configured for mgmt plane. It wont look up firewalls routing table. If you specify source as specific data plane interface, then it will use that interface IP as source and will look into your routing table to forward the traffic.


for ping host

It is expected to go through mgmt plane as you have not defined any specific source. Validate if anything is blocking this PING traffic on the gateway of your mgmt plane or on further hops.


for ping source <our_public_interface_addr> host

This sounds like intrazone traffic and will exit through your external interface. There is chance that you might not notice traffic log for this if log generation is not enabled on default intrazone rule. Also as peer device is PA, validate if you have applied any interface management profile on the external interface of peer firewall which is restricting PING to only certain IP's.


Everything was configured correctly.

You know what solved the problem?? - Firewall Restart 😐

Mighty restart to the rescue. Glad your issue is resolved @rjdahav163 

  • 1 accepted solution
  • 4 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!