This actually works! Traffic is dropped by the interzone-default rule.
Ok, so we have 2 palo alto firewalls;
1. On-prem with site-to-site tunnel to azure native vpn gateway
2. The other one is dedicated for GP.
Now, GP palo can reach the GP clients, thanks to you i allow interzone comms.
Problem now is, our on prem palo can reach all the interfaces Eth1 Untrust, Eth2 Trust of the GP FW but not the GP subnets. And this time, no logs at all.
Additionally, GP clients can reach the on-prem palo and subnets inside it.
Do you have a route on the on-prem NGFW to the GP subnet that points to the tunnel?
- YES! Azure NGFW’s management and GP subnets are pointing to tunnel.
Do you have a rule on the on-prem NGFW that allows traffic to the GP subnet?
- YES! Bi-directional.
Do you have a rule on the Azure NGFW that allows traffic to GP for S2S VPN?
- On-prem NGFW tunnels with Azure Native VPN Gateway. I enabled the intra and interzone loggs – this should capture anything not matched right?
What do the traffic logs show on the on-prem and Azure NGFWs for the pings that fail?
- I can see the traffic going out of On-prem NGFW but not arriving at Azure NGFW. Ping test to interfaces logged and worked but not to the GP Subnet.
Azure NGFW only sees traffic going to the interfaces, but not destined to GP subnet.
PING from Azure NGFW works but not from the Onprem NGFW.
Hi Tom,
Do you have a route on the on-prem NGFW to the GP subnet that points to the tunnel?
- YES! Azure NGFW’s management and GP subnets are pointing to tunnel.
Do you have a rule on the on-prem NGFW that allows traffic to the GP subnet?
- YES! Bi-directional.
Do you have a rule on the Azure NGFW that allows traffic to GP for S2S VPN?
- On-prem NGFW tunnels with Azure Native VPN Gateway. I enabled the intra and interzone loggs – this should capture anything not matched right?
What do the traffic logs show on the on-prem and Azure NGFWs for the pings that fail?
- I can see the traffic going out of On-prem NGFW but not arriving at Azure NGFW. Ping test to interfaces logged and worked but not to the GP Subnet.
Azure NGFW only sees traffic going to the interfaces, but not destined to GP subnet.
Hi Tom,
Do you have a route on the on-prem NGFW to the GP subnet that points to the tunnel?
- YES! Azure NGFW’s management and GP subnets are pointing to tunnel.
Do you have a rule on the on-prem NGFW that allows traffic to the GP subnet?
- YES! Bi-directional.
Do you have a rule on the Azure NGFW that allows traffic to GP for S2S VPN?
- On-prem NGFW tunnels with Azure Native VPN Gateway. I enabled the intra and interzone loggs – this should capture anything not matched right?
What do the traffic logs show on the on-prem and Azure NGFWs for the pings that fail?
- I can see the traffic going out of On-prem NGFW but not arriving at Azure NGFW. Ping test to interfaces logged and worked but not to the GP Subnet.
Azure NGFW only sees traffic going to the interfaces, but not destined to GP subnet.
Do you have a route on the on-prem NGFW to the GP subnet that points to the tunnel?
- YES! Azure NGFW’s management and GP subnets are pointing to tunnel.
Do you have a rule on the on-prem NGFW that allows traffic to the GP subnet?
- YES! Bi-directional.
Do you have a rule on the Azure NGFW that allows traffic to GP for S2S VPN?
- On-prem NGFW tunnels with Azure Native VPN Gateway. I enabled the intra and interzone loggs – this should capture anything not matched right?
What do the traffic logs show on the on-prem and Azure NGFWs for the pings that fail?
- I can see the traffic going out of On-prem NGFW but not arriving at Azure NGFW. Ping test to interfaces logged and worked but not to the GP Subnet.
Azure NGFW only sees traffic going to the interfaces, but not destined to GP subnet.
Do you have a route on the on-prem NGFW to the GP subnet that points to the tunnel?
- YES! Azure NGFW’s management and GP subnets are pointing to tunnel.
