Troubleshoot VM Panorama with multiple interfaces

[aleksandar.astardzhiev]

Hi All,

We have few virtual Panoramas running 8.1 that are needs to managed firewalls into two different zones with no connection between them. For that reason we have configured the Panorama with multiple interface.

- The mgmt interface in used for access to the Panorama as well as managing some if the firewalls

- Eth1/1 interface is used for managing the rest of the firewalls in the second zone

We already have few similar setups and everything is working fine. During the last setup we had few typos in the panorama config (the default gw for the eth1/1 was wrong and the fw ip was not in the permitted IPs)

My real problem is that there is no way you can troubleshoot the connectivity between the firewall and the panorama on the second interface.

- The tcpdump command on the panorama is listening only on the mgmt interface and it seems there is no way you can see what is hitting the second interface.

- It seems panorama doesn't support the "packet capture" similar to the firewalls.

- It seems you cannot "show interface" for status and statistics any non-management interface on the panorama

From my point of view there is no way you can confirm if traffic from the firewall is reaching the panorama and if yes, does it reply - if the firewall is connecting to non-management interface on the panorama.

I was hoping if any of you have find some any commands that can help troubleshoot connectivity over non-management interface.

[batd2]

@aleksandar.astardzhiev I am not sure what Panorama model and PanOS version you have, but we have physical M applience on 8.1 and the interface troubleshooting commands are there, e.g."> show interface ethernet1/2",  "> tcpdump interface ethernet1/2" . 

[aleksandar.astardzhiev]

Hi @batd2,

All of our Panoramas are virtual. All of them are running on 8.1 and none of them support the command you have:

user@panorama> show interface 
  management   Show management interface information

user@panorama> show interface ethernet1/1
ethernet1/1 is not one of <management>

Invalid syntax.

It seems that the physical devices are supporting these commands, but the virtual don't. Which is weird...