NGFW routing internet traffic help

[ebryan]

I am setting up a very simple PA200 implementation and all I need at this stage is to be able to contact the Palo update server to update the PanOS.  I have the FW plugged in directly from ethernet1/1 to the modem (subnet 192.168.0.1).  The gateway is pingable.  My machine is connected to the the management interface (172.16.30.35).  I have  virtual router configured to send all traffic (0.0.0.0/0) out of ethernet1/1.  I have an any/any security policy set.  I have a NAT rule (I suspect this is the problem) configured to translate the networks to each other (at least that's my intention).  I know the issue is something simple but I can't get past it. Any help would be appreciated.

[Remo]

Ok, then ...

• What zone did you assign to loopback.1?
• Did you ad the loopback interface to the same virtual router as ethernet1/1 (your "external" interface)?
• Did you check the trafficlogs for connections from 192.168.0.1 towards the configured dns servers on port 53?
• Did you commit the configuration prior to checking for new updates?

[Remo]

... or configure the interface eth1/2 as layer2 and also another port to the same layer 2 vlan and there is no need for a switch/hub 😉😉

[ebryan]

loopback.1 is in the untrust zone

The loopback and interface 1/1 are both on the same virtual router

I can see log entries from 192.168.0.1 to the configured DNS servers

Yes, I committed the changes prior to testing

[Remo]

In these sessions in the trafficlog, is NAT applied there?

[ebryan]

Yes. This is the NAT policy:

[Remo]

Try a completely different IP on loopback.1 (for example 172.16.255.255/32). Because right now your loopback and the eth1/1 probably generate an IP conflict.

[ebryan]

I think that did it.  I've got a different error now which I don't think you guys can help me with.

[LAYER_8]

If you go to the device tab, scroll down to licenses, retrieve keys from server, assuming you gave your MGT interface a DNS server, it will request the licenses purchased for the device. If you need to purchase licenses, talk to a reseller about a LAB unit, or use a pay-as-you-go firewall in the public cloud, instead. 

[Imogenzampa]

A virtual router is a function of the firewall that participates in Layer 3 routing ... In addition to routing to other network devices, virtual routers mycfavisit