- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
07-24-2023 05:24 AM
Hi All,
I am configuring the VM Firewall. I will not be able to manage the Firewall with the Mgmt Interface as customer has restricted only internet access and MPLS access. So decided to manage it via MPLS interface.
There are 3 network adapters in ESXi host as per KB.
1 - Mgmt
2 - eth1/1
3 - eth1/2
Initially i configured eth1/1 with the /29 subnet and assigned the default VR. Created a Zone and assigned it as well.
I can see the eth1/1 interface is up but unable to see any arp entries learning.
Created a default route 0.0.0.0 pointing to the next hop address in the same /29 subnet.
Example: 10.10.10.1/29 - FW
10.10.10.2/29 - Nexthop
I am unable to ping the nexthop. not able to see the arp. Tried pinging from the source as 10.10.10.1 host 10.10.10.2 still getting the error Network not reachable.
Am i missing something here? Please suggest.
Regards,
Sanjay S
07-24-2023 09:12 AM
Hello there
What does your security policy look like? What does your Traffic Log show?
When you went into CLI to do your ping, what was your exact syntax?
Does it match "ping source 10.10.10.1 host 10.10.10.2"?
By default, the pings come from the management interface.
Let us know how else we can assist?
07-24-2023 10:02 PM
@S.Cantwell thank you for looking into this.
Yes this is the format i am using "ping source 10.10.10.1 host 10.10.10.2"
Also ACL, by default intrazone is ANY allowed right so did not create any additional rule.
I am not much familiar with CLI captures in Palo what would be the best wat to capture please suggest.
My only concern is even after adding the default route it says network not reachable for the Default Gateway itself.
Regards,
Sanjay S
07-25-2023 03:13 AM - edited 07-25-2023 03:13 AM
Hello
You are facing connectivity issues while trying to manage the VM Firewall via the MPLS interface (eth1/1). Check VLAN configuration, physical connectivity, IP settings, and ARP. Ensure proper routing, firewall rules, and next-hop device configuration. Involve your ISP or network administrator if needed. Seek guidence from https://live.paloaltonetworks.com/t5/network-security/
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!