Routing driving me crazy

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Routing driving me crazy

L3 Networker

Hi folks,

 

here's a weird issue!

We have one public IP lets say 1.2.3.4.

Our PA VM 300, can ping to any public IP address other than 1.2.3.4.

For all other public IP addresses, it sends traffic via default route out of external interface. But for 1.2.3.4, it sends the traffic to our management gateway. Following to be noted:

1. 1.2.3.4 is our other PA firewall external IP where we were trying to connect using IPSec S2S tunnel. I deleted all the tunnel config since I was afraid that it was somehow interfering with the routing. But that did not solve the problem.

 

2. From all other devices we can ping 1.2.3.4 and ping is allowed on this interface.

 

3. Security Policies, NAT and static default route pointing out from external interface to next hop are all correct.

 

4. We can ping other public IP addresses like 8.8.8.8 and even FQDNs like www.facebook.com but only traffic to 1.2.3.4 is routed through management interface.,

 

Any ideas anyone?

1 accepted solution

Accepted Solutions

@Rajesh12 

Everything was configured correctly.

You know what solved the problem?? - Firewall Restart 😐

View solution in original post

4 REPLIES 4

L3 Networker

Also,

 

we tried using

 

ping host 1.2.3.4

ping source <our_public_interface_addr> host 1.2.3.4

 

No luck using both!

@rjdahav163 

 

Whenever you try to ping an IP from firewall, by default it will use your mgmt plane and then will forward traffic to gateway configured for mgmt plane. It wont look up firewalls routing table. If you specify source as specific data plane interface, then it will use that interface IP as source and will look into your routing table to forward the traffic.

 

for ping host 1.2.3.4

It is expected to go through mgmt plane as you have not defined any specific source. Validate if anything is blocking this PING traffic on the gateway of your mgmt plane or on further hops.

 

for ping source <our_public_interface_addr> host 1.2.3.4

This sounds like intrazone traffic and will exit through your external interface. There is chance that you might not notice traffic log for this if log generation is not enabled on default intrazone rule. Also as peer device is PA, validate if you have applied any interface management profile on the external interface of peer firewall which is restricting PING to only certain IP's.

@Rajesh12 

Everything was configured correctly.

You know what solved the problem?? - Firewall Restart 😐

Mighty restart to the rescue. Glad your issue is resolved @rjdahav163 

  • 1 accepted solution
  • 3828 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!