Cannot ping inside interface from Windows PC with inside interface set as GW

[donovanrodriguez1997]

I'm going a little bit crazy. I have a super simple setup, I have a Windows PC @ 10.0.0.10

My PA 440 has 10.0.0.11 as its MGT Interface and all communications between the Windows PC and the management interface work fine. I have an inside interface set as eth 1/8 Layer 3 with an IP of 10.0.0.1 and its assigned to the inside zone. Eth 1/8 is also layer 3 and assigned to the outside zone. I created an interface management profile that allows Ping, ssh, http, and response pages and explicitly allows the 10.0.0.0/24 network. However, no matter what I do, I cannot ping from my PC to the actual data interface of the firewall. Its also not able to get out to the internet even though the outside interface is able to communicate with the internet. I have a security rule that allows inside to outside for any source and destination. What am I missing here??

[Claw4609]

Hello,

Do you see the attempted traffic in the firewalls traffic logs? If not, something to check would be the subnet mask of the client itself and make sure is 255.255.255.0 in your case. Secondly for the internet piece, is there a firewall rule allowing this traffic? Do you see this traffic in the firewall? If you see the traffic and its allowed, either your routing or your NAT rule may need to be whats looked at 

[donovanrodriguez1997]

The subnet mask is correct at 255.255.255.0

My nat policy converts from inside -> outside using the ip address of the outside interface connecting to my ISP. Would having a C9200 Cisco switch in between the Firewall and the PC make any difference? The virtual router I have configured is assigned to my two interfaces and it just has one static route for 0.0.0.0/0 going out the outside interface with the next hop of the gateway for the network.  

[Claw4609]

Switch in-between is fine, just depends how everything is configured, is your switch just operating as a layer 2 switch or is the clients default gateway on the switch? Are you seeing the clients traffic appear in the traffic logs of the firewall or no? 

Would also recommend checking the global counters on the firewall, as if the traffic is hitting the firewall and then failing, there is a good chance these counters will provide a direction on where to look. KB article on this: How to check global counters for a specific source and destinat... - Knowledge Base - Palo Alto Netw...

[donovanrodriguez1997]

So I see the attempted pings from my PC to the firewall. The action is set to allow, but I'm still not getting anything back on my PC and I'm still not able to touch the internet, but my firewall is able to download updates... 

[Claw4609]

It the traffic is hitting the firewall I would refer to that KB article and check the counters if they can provide more information where to look. 

[donovanrodriguez1997]

Here's what I get from that counter filter. I have a ping going to the gateway address running while I did the filter:

 

[donovanrodriguez1997]

Doesn't really seem to tell me that its dropping any packets or anything. I'm so confused...

[Claw4609 · Accepted solution]

On the firewall if you do "show routing route" do you see 10.0.0.0/24 as a directly connected route? Can you ping the machine sourcing from the firewall? ping source 10.0.0.1 host 10.0.0.10

[donovanrodriguez1997]

It didn't exactly solve the issue but you helped me get there haha. I feel a bit stupid but I guess the syntax for applying the ip address is 10.0.0.1/24, I just had 10.0.0.1... gotta drink the humble tea every once n a while. Thanks a bunch dude.