NGFW routing internet traffic help

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

NGFW routing internet traffic help

L1 Bithead

I am setting up a very simple PA200 implementation and all I need at this stage is to be able to contact the Palo update server to update the PanOS.  I have the FW plugged in directly from ethernet1/1 to the modem (subnet  The gateway is pingable.  My machine is connected to the the management interface (  I have  virtual router configured to send all traffic ( out of ethernet1/1.  I have an any/any security policy set.  I have a NAT rule (I suspect this is the problem) configured to translate the networks to each other (at least that's my intention).  I know the issue is something simple but I can't get past it. Any help would be appreciated.







Accepted Solutions


So currently probably the firewall or at least the default-vr has internet access but not your management interface as this one is conected to your computer. The route table of the management plane is completely separated from other dataplane configurations (all the actual firewallinterfaces). In a default configuration the firewall tries to reach everything from the management interface which means the firewalls tries to download updates for example over your computer. I see now two possiblities

  1. You connect the firewalls managementinterface to eth1/2. This should enable internet access for the firewall but in your current configuration you then don't have a connection to the firewall.
  2. You configure serviceroutes on the firewall. Under Device > Setup > Services > Service Features > Service Route Configuration you can specify another interface than the managementport as source for specific services like dns, paloalto updates. When you change this the firewall should be able to reach the dns servers and download the updates Screenshot_20210703-182039_Chrome.jpg

In your situation I propose to use possibility 2 and change the sourceinterface for the services that require internet access. If you do this, then a firewallpolicy is required to allow that traffic but as you already have an any-any-allow rule this shouldn't be a problem.

View solution in original post


Cyber Elite
Cyber Elite


Is your intention to make the PA-200 sit at the edge of your home network? Assuming that this is the case, your NAT statement as presently configured doesn't really make much sense unless you have a route on your modem/router (assuming you aren't talking about an actual straight modem) combo unit pointing back to your firewall. Otherwise you wouldn't have a return route pointing the traffic back to your firewall. 


Generally for a home setup your NAT statement would simply have your source-translation setup like so:

Translation Type: Dynamic IP And Port

Address Type: Interface Address

Interface: ethernet1/1

IP address: None (Assuming DHCP assignment, otherwise you can select the static address from the drop down)

What this will do is simply NAT all of the traffic through the address assigned to your ethernet1/1 address and out through the modem. This then allows your modem to know where it has to return the traffic without any additional route configuration. 


L7 Applicator

also...   have you really put your external interface into the trust zone?  if not then perhaps the NAT destination should be "untrust"

Thanks for your help. I have updated the NAT statement as such.  I'm still not getting internet connectivity, though.  What other information do you need for us to continue troubleshooting?




Thanks for pointing that out.  I have made that correction as well.


can you share me route table output.


you can use below steps to get it.

>network > virtual Routers><vr-name> >more runtime stats


And also try to test ( internet, security policy, ping etc) from below step.


device > Troubleshooting >



Best Regards,



Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!