Virtual Wire silently discarding packets directed to ip addresses of a L3 interface

[cnrpisa]

I have a PA-4020 with PanOS 4.0.3. Policies are mailnly applied to traffic flowing through two parallel Virtual Wires. I have also defined some L3 interfaces , in order to set up some SSL-VPNs. I have noticed that packets whose destination IP address is the IP address of an L3 interface are not allowed to go through the Virtual Wires, even if my policies permit their transit. There is non trace of the discarded packets in the logs. I suspect this is a bug. Did others experiment the same problem?

[pkruse]

You going to need to provide some topology information. Your description sounds as though you have two L3 interfaces in parallel with two sets of vwire interfaces. If you are convinced this is a bug it will require a case be opened with technical support so that it can be reproduced and a bug generated so that it can be fixed.

~Phil

[cnrpisa]

I've enclosed a picture showing my setup. In the situation described in the picture, pings sent from 146.48.99.254 to 146.48.99.251 time out. All other pings from 146.48.99.254 to other addresses in subnet 146.48.96.0/22 succeed. If the virtual wire is bypassed, 146.48.99.254 can ping also 146.48.99.251.

My intention was to use 146.48.99.251 as a gateway for an SSL-VPN. I have found a work-around, so I can survive even with this strange behaviour of the PA-4020.

Before submitting a case, I would like to know if my planned setup was wrong.

[jdavis]

cnrpisa wrote:
I've enclosed a picture showing my setup. In the situation described in the picture, pings sent from 146.48.99.254 to 146.48.99.251 time out. All other pings from 146.48.99.254 to other addresses in subnet 146.48.96.0/22 succeed. If the virtual wire is bypassed, 146.48.99.254 can ping also 146.48.99.251.
My intention was to use 146.48.99.251 as a gateway for an SSL-VPN. I have found a work-around, so I can survive even with this strange behaviour of the PA-4020.
Before submitting a case, I would like to know if my planned setup was wrong.

cnrpisa,

Do you have a managment profile that allows ping applied to interface e1/1.96 on the PA-4020?  It sounds like this is the problem based on the information you've provided.  Remember, the firewall's interface will not reply to pings without a management profile that allows ping applied to that interface.

Best Regards,

Jared

[cnrpisa]

The management profile of Ethernet1/1.96 is OK. The proof is that when I bypass the Virtual Wire by connecting the M7i directly to the LAN switch all pings succeed.

[pkruse]

Does your monitor show the ping? Can you see the session from the CLI?

"show session all filter source xxx.xxx.xxx.xxx application ping"

[cnrpisa]

The problem has been eliminated in version 4.0.5.