About Susan_Avxt

    1. All the units in above diagram are AWS EC2s. Pinging from Ubuntu10_20_61_16     to Ubuntu10_60_0_100 failed due to echo reply dropped on PA-VM.   admin@PA-VM> show counter global filter packet-filter yes delta yes severity drop Global counters: Elapsed time since last sampling: 1.16  seconds name                                   value     rate severity  category  aspect    description -------------------------------------------------------------------------------- flow_fwd_zonechange    1      0 drop      flow      forward   Packets dropped: forwarded to different zone -------------------------------------------------------------------------------- Total counters shown: 1   2. Following is the routing info.   admin@PA-VM> show routing route flags: A:active, ?:loose, C:connect, H:host, S:static, ~:internal, R:rip, O:ospf, B:bgp,        Oi:ospf intra-area, Oo:ospf inter-area, O1:ospf ext-type-1, O2:ospf ext-type-2, E:ecmp, M:multicast VIRTUAL ROUTER: vr1 (id 1)   ========== destination                                 nexthop                                 metric flags      age   interface          next-AS 0.0.0.0/0                                   10.20.10.1                              10     A S              ethernet1/1 10.20.10.0/24                           10.20.10.50                             0      A C              ethernet1/1 10.20.10.50/32                         0.0.0.0                                     0      A H 10.20.61.0/24                          10.20.61.195                            0      A C              ethernet1/2 10.20.61.195/32                      0.0.0.0                                      0      A H 10.60.0.0/24                            0.0.0.0                                     10     A S              tunnel.1 total routes shown: 6   3. Following is the Zones info   4. Following is the security policies info.    5. From the log below, we can see when ping from 10.20.61.16 to 10.60.0.100. it is from Pub-zone to VPN zone. ping packet goes from e1/2 to e1/1, then e1/1 goes to tunnel.1. But seems ping reply didn't take path, tunnel.1-->e1/1--->e1/2.   admin@PA-VM> test routing fib-lookup ip 10.20.61.16 virtual-router vr1 -------------------------------------------------------------------------------- runtime route lookup -------------------------------------------------------------------------------- virtual-router: vr1 destination: 10.20.61.16 result: interface ethernet1/2, source 10.20.61.195 -------------------------------------------------------------------------------- 6. Guess ping reply didn't  go the right path. So got "Packets dropped: forwarded to different zone". 7. There is no NAT rules on PA-VM. How to fix this issue? Thanks for sharing your thoughts! ... View more