here's a weird issue!
We have one public IP lets say 18.104.22.168.
Our PA VM 300, can ping to any public IP address other than 22.214.171.124.
For all other public IP addresses, it sends traffic via default route out of external interface. But for 126.96.36.199, it sends the traffic to our management gateway. Following to be noted:
1. 188.8.131.52 is our other PA firewall external IP where we were trying to connect using IPSec S2S tunnel. I deleted all the tunnel config since I was afraid that it was somehow interfering with the routing. But that did not solve the problem.
2. From all other devices we can ping 184.108.40.206 and ping is allowed on this interface.
3. Security Policies, NAT and static default route pointing out from external interface to next hop are all correct.
4. We can ping other public IP addresses like 220.127.116.11 and even FQDNs like www.facebook.com but only traffic to 18.104.22.168 is routed through management interface.,
Any ideas anyone?
Whenever you try to ping an IP from firewall, by default it will use your mgmt plane and then will forward traffic to gateway configured for mgmt plane. It wont look up firewalls routing table. If you specify source as specific data plane interface, then it will use that interface IP as source and will look into your routing table to forward the traffic.
for ping host 22.214.171.124
It is expected to go through mgmt plane as you have not defined any specific source. Validate if anything is blocking this PING traffic on the gateway of your mgmt plane or on further hops.
for ping source <our_public_interface_addr> host 126.96.36.199
This sounds like intrazone traffic and will exit through your external interface. There is chance that you might not notice traffic log for this if log generation is not enabled on default intrazone rule. Also as peer device is PA, validate if you have applied any interface management profile on the external interface of peer firewall which is restricting PING to only certain IP's.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!