VM Firewall Setup

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

VM Firewall Setup

L4 Transporter

Hi All,

I am configuring the VM Firewall. I will not be able to manage the Firewall with the Mgmt Interface as customer has restricted only internet access and MPLS access. So decided to manage it via MPLS interface.

There are 3 network adapters in ESXi host as per KB.

1 - Mgmt

2 - eth1/1

3 - eth1/2

 

Initially i configured eth1/1 with the /29 subnet and assigned the default VR. Created a Zone and assigned it as well. 

I can see the eth1/1 interface is up but unable to see any arp entries learning.

Created a default route 0.0.0.0 pointing to the next hop address in the same /29 subnet.

Example: 10.10.10.1/29 - FW

10.10.10.2/29 - Nexthop

 

I am unable to ping the nexthop. not able to see the arp. Tried pinging from the source as 10.10.10.1 host 10.10.10.2 still getting the error Network not reachable. 

 

Am i missing something here? Please suggest.

 

Regards,

Sanjay S

3 REPLIES 3

Cyber Elite
Cyber Elite

Hello there

 

What does your security policy look like?   What does your Traffic Log show? 

When you went into CLI to do your ping, what was your exact syntax?
Does it match "ping source 10.10.10.1 host 10.10.10.2"?

By default, the pings come from the management interface.

Let us know how else we can assist?

Help the community: Like helpful comments and mark solutions

L4 Transporter

@SCantwell_IM thank you for looking into this.

Yes this is the format i am using "ping source 10.10.10.1 host 10.10.10.2"

Also ACL, by default intrazone is ANY allowed right so did not create any additional rule.

I am not much familiar with CLI captures in Palo what would be the best wat to capture please suggest.

My only concern is even after adding the default route it says network not reachable for the Default Gateway itself.

Regards,

Sanjay S

L1 Bithead

Hello

You are facing connectivity issues while trying to manage the VM Firewall via the MPLS interface (eth1/1). Check VLAN configuration, physical connectivity, IP settings, and ARP. Ensure proper routing, firewall rules, and next-hop device configuration. Involve your ISP or network administrator if needed. Seek guidence from https://live.paloaltonetworks.com/t5/network-security/

  • 768 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!