VM Firewall Setup

[Sanjay_Ramaiah]

Hi All,

I am configuring the VM Firewall. I will not be able to manage the Firewall with the Mgmt Interface as customer has restricted only internet access and MPLS access. So decided to manage it via MPLS interface.

There are 3 network adapters in ESXi host as per KB.

1 - Mgmt

2 - eth1/1

3 - eth1/2

Initially i configured eth1/1 with the /29 subnet and assigned the default VR. Created a Zone and assigned it as well. 

I can see the eth1/1 interface is up but unable to see any arp entries learning.

Created a default route 0.0.0.0 pointing to the next hop address in the same /29 subnet.

Example: 10.10.10.1/29 - FW

10.10.10.2/29 - Nexthop

I am unable to ping the nexthop. not able to see the arp. Tried pinging from the source as 10.10.10.1 host 10.10.10.2 still getting the error Network not reachable. 

Am i missing something here? Please suggest.

Regards,

Sanjay S

[S.Cantwell]

Hello there

What does your security policy look like?   What does your Traffic Log show? 

When you went into CLI to do your ping, what was your exact syntax?
Does it match "ping source 10.10.10.1 host 10.10.10.2"?

By default, the pings come from the management interface.

Let us know how else we can assist?

[Sanjay_Ramaiah]

@S.Cantwell thank you for looking into this.

Yes this is the format i am using "ping source 10.10.10.1 host 10.10.10.2"

Also ACL, by default intrazone is ANY allowed right so did not create any additional rule.

I am not much familiar with CLI captures in Palo what would be the best wat to capture please suggest.

My only concern is even after adding the default route it says network not reachable for the Default Gateway itself.

Regards,

Sanjay S

[stevediaz]

Hello

You are facing connectivity issues while trying to manage the VM Firewall via the MPLS interface (eth1/1). Check VLAN configuration, physical connectivity, IP settings, and ARP. Ensure proper routing, firewall rules, and next-hop device configuration. Involve your ISP or network administrator if needed. Seek guidence from https://live.paloaltonetworks.com/t5/network-security/