VM series promiscuous issue?

[RichardThornton]

Hi,

Just messing about with a VM-100 and three other VM's on vSphere 5.5...All setup for layer 3.

Ubuntu1 <> VM100 <> Vyatta <> Ubuntu2

Three vSwitches, promiscuous mode on reject

Ubuntu1 to VM100 10.x.x.x/24 network

VM100 to Vyatta 172.16.x.x/24 network

Vyatta to Ubuntu2 192.168.x.x/24 network

Policy all setup, default routes on all four VM's pointing in the right directions.

I can't ping from one ubuntu to the other ubuntu.  My pings only go as far as the closest router.

The problem area seems to be the vSwitch between the VM100 and Vyatta, this vSwitch is the only one without a physical NIC bound to it.

I have seen the tech note about disabling promiscuous mode for L3 so I may try that tomorrow.

Any other ideas?

Thanks.

Richard

[jwolach]

Hi Richard,

Yes, you need to enable promiscuous mode on the vSwitches. Change it from Reject to Accept.

Thanks,

Jeff

[knarra1]

Hello Richard,

If the firewall is deployed in layer 3 mode, make sure the VM NIC settings in firewall VM matches to the firewall determined interface Mac address . You will have to shutdown the firewall VM in vsphere and manually edit the MAC address for each vmNIC in vSphere to match what is assigned on the VM-Series firewall

If you are deploying the VM-Series firewall using layer 2, virtual wire, or tap interfaces you must enable promiscuous mode on the port group of the virtual switch to which the data interfaces on the firewall are attached. If promiscuous mode is not enabled, the firewall will not receive any traffic because the destination MAC addresses assigned by PAN-OS will be different from the vmNIC MAC addresses assigned by vSphere.

[sspringer]

Hello,

The VM-Series Deployment Guide provides an alternative to enabling promiscuous mode for layer3 deployments.

VM-Series Deployment Guide 6.0 (English)

Virtualization_Admin_Guide_6.0 page 11(section Requirements):

"If you are deploying the VM-Series firewall using layer 3 interfaces, you can instead set the vmNIC MAC

address to match the PAN-OS MAC address by manually editing the MAC address for each vmNIC in

vSphere to match what is assigned on the VM-Series firewall. This change must be done while the VM-Series

is powered off; it allows the firewall to receive frames that are meant for it."

Cheers,

Stefan

[RichardThornton]

Thanks everyone, working with the changes suggested here:

https://live.paloaltonetworks.com/docs/DOC-6954