Just messing about with a VM-100 and three other VM's on vSphere 5.5...All setup for layer 3.
Ubuntu1 <> VM100 <> Vyatta <> Ubuntu2
Three vSwitches, promiscuous mode on reject
Ubuntu1 to VM100 10.x.x.x/24 network
VM100 to Vyatta 172.16.x.x/24 network
Vyatta to Ubuntu2 192.168.x.x/24 network
Policy all setup, default routes on all four VM's pointing in the right directions.
I can't ping from one ubuntu to the other ubuntu. My pings only go as far as the closest router.
The problem area seems to be the vSwitch between the VM100 and Vyatta, this vSwitch is the only one without a physical NIC bound to it.
I have seen the tech note about disabling promiscuous mode for L3 so I may try that tomorrow.
Any other ideas?
If the firewall is deployed in layer 3 mode, make sure the VM NIC settings in firewall VM matches to the firewall determined interface Mac address . You will have to shutdown the firewall VM in vsphere and manually edit the MAC address for each vmNIC in vSphere to match what is assigned on the VM-Series firewall
If you are deploying the VM-Series firewall using layer 2, virtual wire, or tap interfaces you must enable promiscuous mode on the port group of the virtual switch to which the data interfaces on the firewall are attached. If promiscuous mode is not enabled, the firewall will not receive any traffic because the destination MAC addresses assigned by PAN-OS will be different from the vmNIC MAC addresses assigned by vSphere.
The VM-Series Deployment Guide provides an alternative to enabling promiscuous mode for layer3 deployments.
Virtualization_Admin_Guide_6.0 page 11(section Requirements):
"If you are deploying the VM-Series firewall using layer 3 interfaces, you can instead set the vmNIC MAC
address to match the PAN-OS MAC address by manually editing the MAC address for each vmNIC in
vSphere to match what is assigned on the VM-Series firewall. This change must be done while the VM-Series
is powered off; it allows the firewall to receive frames that are meant for it."
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!