VPN user cannot access another network segment

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

VPN user cannot access another network segment

Not applicable

Hi All

I just established a VPN between two sites. the user over the site has no issue contacting my LAN IP segment (172.20.4.X) and but they just couldnt access to another of my LAN IP segment (172.20.6.x)

I have check under the virtual router that segment was already included. did I miss out on something or where should I be looking at?

Thank for helping guys!

1 accepted solution

Accepted Solutions

L5 Sessionator

If the tunnel is not between two Palo Alto Firewalls make sure that you have proxy ID's under Network---> IPSec Tunnels for the network that is not able to pass the traffic.

Also if that is not the case to further debug you can also do the following to see what might be causing the issue

1. Need to setup the filters for the traffic we are interested in. To do this, execute the following steps:

Navigate to Monitor--Packet Capture

Click 'Manage Filters'

Set Filter ID 1 to be the source IP and destination IP of traffic you feel is affected ( leave all other fields blank )

Set Filter ID 2 to be the exact inverse of what you did in step 3 (destination IP in source field, Source IP in destination field)

2. Setup up the captures

Create and name the file stage for a packet capture on all the stages (receive, transmit, firewall and drop)

3. Enable filters and captures

debug dataplane packet-diag set filter on

debug dataplane packet-diag set capture on

4. open 2 CLI windows

on 1 run the following command to look at the counter ( make sure it run this command once before running the traffic)

show counter global filter packet-filter yes delta yes

on the 2nd window run the following command to look at he sessions

show session all filter source <ip address> destination <ip address>

5. Now run the test for ftp while it is failing to look at the counters and captures and sessions to determine what is causing the issue.

6. Once you have finished testing and capturing. Make sure to turn off the debugs.

Thanks

View solution in original post

3 REPLIES 3

L5 Sessionator

1>Check if the traffic for (172.20.6.x) is able to egress out of Peer firewall.

2>PA firewall is able to reach this segment locally using source ping.   (>ping source <LAN i/f IP > host  <IP in (172.20.6.x>

3>Security Rule configured for  Tunnel-zone to LAN Zone is allowing IP segment (172.20.6.x) on PA firewall.

If tunnel interface has been configured under a separate zone ,you would be able to dig in using traffic logs,if the traffic is  reaching  PA firewall.


L5 Sessionator

If the tunnel is not between two Palo Alto Firewalls make sure that you have proxy ID's under Network---> IPSec Tunnels for the network that is not able to pass the traffic.

Also if that is not the case to further debug you can also do the following to see what might be causing the issue

1. Need to setup the filters for the traffic we are interested in. To do this, execute the following steps:

Navigate to Monitor--Packet Capture

Click 'Manage Filters'

Set Filter ID 1 to be the source IP and destination IP of traffic you feel is affected ( leave all other fields blank )

Set Filter ID 2 to be the exact inverse of what you did in step 3 (destination IP in source field, Source IP in destination field)

2. Setup up the captures

Create and name the file stage for a packet capture on all the stages (receive, transmit, firewall and drop)

3. Enable filters and captures

debug dataplane packet-diag set filter on

debug dataplane packet-diag set capture on

4. open 2 CLI windows

on 1 run the following command to look at the counter ( make sure it run this command once before running the traffic)

show counter global filter packet-filter yes delta yes

on the 2nd window run the following command to look at he sessions

show session all filter source <ip address> destination <ip address>

5. Now run the test for ftp while it is failing to look at the counters and captures and sessions to determine what is causing the issue.

6. Once you have finished testing and capturing. Make sure to turn off the debugs.

Thanks

Not applicable

Hi

The issue is resolved and this is what I did.

I realise that the VPN tunnel over the other site is only pointing to my LAN IP segment (172.20.4.X) and not the other segment. I added the 172.20.6.x segment into the VPN tunnel

I am not sure if adding the IP segment under the Proxy ID of the Palo Alto is the resolution of my issue. But i did that and once I commit the policy, the ping test start to show reply.

I didnt try the packet capture test

  • 1 accepted solution
  • 2378 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!