Secondry ISP not able to ping form external.

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Secondry ISP not able to ping form external.

L1 Bithead

 I have two ISP connected to my firewall.
1. ISP1 is in untrust zone and default route configured metric value is 10.
2. ISP 2 is in WAN1 zone and default route metric value is 15.
3. Both ISP are in same virtual router.


I am facing one issue i cannot ping my ISP2 from external.


My home public ip if i enter  static route in the palo alto firewall in virtual router point to ISP2 interface then only from my home i am able to ping ISP2.

 

Configuretion i made in my PA.

1.policy:  WAN1 to WAN1 all allowed any any 

2. PBF:  configured (Source WAN1 source any) (Destinaiton address any) forward to ISP2 interface and enabled the  Enforce Symmetric Return

3. NAT: Source WAN1 Destination WAN1 Destination Interface ISP2 interface source any destination any translated to Dynamic IP And Port to ISP 2 interface. 

 

Dear Expert Please help me to solve my issue?

8 REPLIES 8

L6 Presenter

Hi @m.habib424169 

 

While configuring the PBF, select source type as Interface because the symmetric return is based on the incoming/outgoing interfaces then check.

 

Keep us posted with the status.

 

SutareMayur_0-1725864833924.png

 

Hope it helps!

M

Check out my YouTube channel - https://www.youtube.com/@NetworkTalks

mhabib424169_0-1725865370575.png

Yes i also treid method before but still cannot. Please help.

I am slo thinking that my PBF is worng. 

L4 Transporter

Hello @m.habib424169 

Your PBF rule should be with action No PBF and enabled Enforce Symmetric Return.

Also, I don't see the meaning of your NAT rule. If you don't disable that NAT rule when you will ping from external your ISP2 interface it will result into a LAND attack and the packet will be silently drop.

Cheers,
Cosmin

Don't forget to Like items if a post is helpful to you!
Please help out other users and “Accept as Solution” if a post helps solve your problem!

Read more about how and why to accept solutions.

Cyber Elite
Cyber Elite

Are you pinging from the firewall towards ISP?

PBF policies do not apply to traffic sourcing from the firewall.

PBF policies apply only to traffic passing through the firewall.

 

If you want to send traffic from inside out towards ISP 2 then source zone in PBF policy needs to be INSIDE not WAN1.

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

I want to ping from external. Actually i want to enable SSLVPN for this interface. 

My source is WAN (outside Any public ip) network. 

 

Please advise what configuration i do?

L4 Transporter

Then you need to configure ECMP on your virtual router and enable symmetric return.

CosminM_0-1725885861214.png

 

More details can be found https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-networking-admin/ecmp/configure-ecmp-on-a-virtu... 

 

Cheers,
Cosmin

Don't forget to Like items if a post is helpful to you!
Please help out other users and “Accept as Solution” if a post helps solve your problem!

Read more about how and why to accept solutions.

Cyber Elite
Cyber Elite

With ECMP and symmetric return also don't forget to set default route metric to the same (currently 10 and 15).

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

ECMP in the virtual router can help resolve the issue by allowing the firewall to use both ISP1 and ISP2 simultaneously for outbound traffic. But in my case ISP1 is primary and ISP2 is secondary. And both interfaces are different Zone.

ISP1 is used for internet treffic
ISP2 i want to USE for IPSEC tunnels and SSLVPN treffic. 

  • 730 Views
  • 8 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!