With out ARP entry internet is not working.

[Satish]

Dear Friends,

I have 2 interfaces in PAN->lan zone and internet zone

ISP router-huawei mac is not learned in palo alto firewall..As a result, Internet not working

But when i add static ARP entry for huawei router in ISP interface, Internet is working fine.

Please suggest to me.Thanks

Regards

Satish

[reaper]

Hi Satish

could you share parts of your config? especially interesting is the configuration of the interfaces and the virtual router + the output of > show routing route and > show arp all

one thing that comes to mind is taht there could be a subnet mismatch between the interface and the IP of the default gateway eg if: 10.0.0.1/25 dg: 10.0.0.254 , this could cause such issue

[ajbool]

Mis-matched network masks configure on the PAN and Huawei devices perhaps?

[Satish]

Hi Tpiens,

Thanks for your reply but i have done the following things:

Disable/delete Source-Nat dynamic and port translated address Policy

Clear session

Ping source internet ip host 4.2.2.2

Then check all of the possible issues noted in this document: https://live.paloaltonetworks.com/docs/DOC-7571

I can't able to findout why it happen...Please suggest.

[Satish]

Hi Ajbool,

Thanks for reply but both device config is same.

Regards

Satish

[reaper]

Hi Satish

can you get the output of:

> show routing route

> show interface all

> show arp all

[HULK]

Hello Satish,

Try to find out 2 possibilities here.

1-- PAN is sending the ARP request, but the ISP router is not responding back. You can take a packet capture on the PAN firewall. Ref DOC: How To Capture ARP Packets on an Interface

2-- PAN FW itself is not sending the ARP broadcast mesage. In this situation, you can forecefully send a Gratuitous ARP (GARP) message to update an ARP table of the ISP routers ARP table. Ref DOC: Trigger a Gratuitous ARP (GARP) from a Palo Alto Networks Device

Hope this helps.

Thanks

[Satish]

Thanks Dud.. Let me check and i will come back to you. Regards Satish