Routing driving me crazy

Reply
Highlighted
L3 Networker

Routing driving me crazy

Hi folks,

 

here's a weird issue!

We have one public IP lets say 1.2.3.4.

Our PA VM 300, can ping to any public IP address other than 1.2.3.4.

For all other public IP addresses, it sends traffic via default route out of external interface. But for 1.2.3.4, it sends the traffic to our management gateway. Following to be noted:

1. 1.2.3.4 is our other PA firewall external IP where we were trying to connect using IPSec S2S tunnel. I deleted all the tunnel config since I was afraid that it was somehow interfering with the routing. But that did not solve the problem.

 

2. From all other devices we can ping 1.2.3.4 and ping is allowed on this interface.

 

3. Security Policies, NAT and static default route pointing out from external interface to next hop are all correct.

 

4. We can ping other public IP addresses like 8.8.8.8 and even FQDNs like www.facebook.com but only traffic to 1.2.3.4 is routed through management interface.,

 

Any ideas anyone?


Accepted Solutions
Highlighted
L3 Networker

Re: Routing driving me crazy

@Rajesh12 

Everything was configured correctly.

You know what solved the problem?? - Firewall Restart

View solution in original post


All Replies
Highlighted
L3 Networker

Re: Routing driving me crazy

Also,

 

we tried using

 

ping host 1.2.3.4

ping source <our_public_interface_addr> host 1.2.3.4

 

No luck using both!

Tags (1)
L2 Linker

Re: Routing driving me crazy

@rjdahav163 

 

Whenever you try to ping an IP from firewall, by default it will use your mgmt plane and then will forward traffic to gateway configured for mgmt plane. It wont look up firewalls routing table. If you specify source as specific data plane interface, then it will use that interface IP as source and will look into your routing table to forward the traffic.

 

for ping host 1.2.3.4

It is expected to go through mgmt plane as you have not defined any specific source. Validate if anything is blocking this PING traffic on the gateway of your mgmt plane or on further hops.

 

for ping source <our_public_interface_addr> host 1.2.3.4

This sounds like intrazone traffic and will exit through your external interface. There is chance that you might not notice traffic log for this if log generation is not enabled on default intrazone rule. Also as peer device is PA, validate if you have applied any interface management profile on the external interface of peer firewall which is restricting PING to only certain IP's.

Highlighted
L3 Networker

Re: Routing driving me crazy

@Rajesh12 

Everything was configured correctly.

You know what solved the problem?? - Firewall Restart

View solution in original post

Highlighted
L2 Linker

Re: Routing driving me crazy

Mighty restart to the rescue. Glad your issue is resolved @rjdahav163 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!