About AndrewMoore

That's  absolutely right @pankaku. I will take a look at your suggestion.   Thank you again. ... View more

Here is some additional info testing the route to my AWS resources.   bob@PA-3020> test routing fib-lookup virtual-router default-vr ip 172.21.1.121 -------------------------------------------------------------------------------- runtime route lookup -------------------------------------------------------------------------------- virtual-router: default-vr destination: 172.21.1.121 result: via 169.254.255.89 interface tunnel.4, source 169.254.255.90, metric 65434 -------------------------------------------------------------------------------- bob@PA-3020> show routing route | match tunnel.4 169.254.255.88/30 169.254.255.90 0 A C tunnel.4   In the GlobalProtect Gatway --> Agent --> Client Settings I added the following Access routes 172.20.0.0/16 172.21.0.0/16   On my connected GlobalProtect VPN client I can confirm the presence of both routes  172.19.0.2 255.255.255.255 On-link 172.19.0.2 256 172.20.0.0 255.255.0.0 On-link 172.19.0.2 1 172.20.255.255 255.255.255.255 On-link 172.19.0.2 256 172.21.0.0 255.255.0.0 On-link 172.19.0.2 1 172.21.255.255 255.255.255.255 On-link 172.19.0.2 256   ... View more

Thanks for the clarification @pankaku. @Pankaj.kumar wrote: yes that's correct. I will let us know if we have reachability from firewall tunnel inteface to aws resources. Also try to ping from firewall's any other interface to aws resources. I assigned 172.21.0.99 to the AWS tunnel and tried to ping an AWS resource with no success.   However, I can ping an AWS resource from the Palo Alto internal gateway interface 172.20.0.1.    Running a packet capture I can see on the receive side ICMP traffic flowing from 172.19.0.2 to 172.21.ABC.EFG and on the transmit side I see ESP traffic flowing from the PA egress interface (public IP) to the AWS resource. ... View more

Hi @pankaku and thank you for the reply. The tunnel interfaces associated with Amazon and the LAN are assigned to the same security profile. I realize this leads to no visibility or control over the traffic and eventually want to assign the AWS tunnel interfaces to a seperate security zone.   Per your suggestion I think I understand you and wanted to summarize what you said as I go about trying what you suggested.   Try assigning an IP address from the GP address pool to the GP tunnel interface and then try pinging a resource in AWS ... View more

Additional Info:   When I issue the command > show routing fib I expected to see a single entry for GlobalProtect, such as 172.19.0.0/16.   Instead I see this:  2 172.20.0.0/16 0.0.0.0 u ethernet1/2 1500 63 172.21.0.0/16 169.254.255.XYZ ug tunnel.4 1427 50 172.19.0.64/26 172.19.0.64 ug tunnel.3 1500 49 172.19.0.32/27 172.19.0.32 ug tunnel.3 1500 48 172.19.0.16/28 172.19.0.16 ug tunnel.3 1500 46 172.19.0.4/30 172.19.0.4 ug tunnel.3 1500 45 172.19.0.2/31 172.19.0.2 ug tunnel.3 1500 47 172.19.0.8/29 172.19.0.8 ug tunnel.3 1500 51 172.19.0.128/26 172.19.0.128 ug tunnel.3 1500 52 172.19.0.192/27 172.19.0.192 ug tunnel.3 1500 53 172.19.0.224/28 172.19.0.224 ug tunnel.3 1500 54 172.19.0.240/29 172.19.0.240 ug tunnel.3 1500 55 172.19.0.248/30 172.19.0.248 ug tunnel.3 1500 Would I need to instead define these networks in my Export and Redistribution Profiles?   Follow Up:   Why would the router implement these CIDR networks instead of a large 172.19.0.0/16 as I defined in the GUI?   Thanks Again! ... View more

Thank you to everyone for your suggestions.    Wanted to let you know the conversion from copper to fiber was a success over lunch today   The solution was I had to issue gratuitous ARPs from a few IPs in my address block - this quickly solved everything.   Cheers to everyone! ... View more

Thanks again @TranceforLife. I can confirm that during the switch to fiber on ethernet1/13 I ran pings from the PA's eth1/13 interface like so: > ping source AAA.BBB.CCC.34 host 8.8.8.8   I will confirm the MAC address tied to the current interface (Cisco) connected to eth1/1.    Thank you to everyone for the big assist this morning. ... View more

Excellent suggestion @Roby_Sreejith!   In my previous posts it's clear that I did not modify the Dynamic NAT policy to use eth1/13 instead of eth1/1.    However, I was trying to ping 8.8.8.8 from the Palo Alto CLI using the AAA.BBB.CCC.34/28 and AAA.BBB.CCC.37 IP addresses, which, I suspect, do not get translated using NAT.   Hope my assumptions are right but happy to be wrong and learn something new (-:   I'll be switching over again today around 12:15 CST so I'll be sure to try your and other suggestions, like clearing ARP tables, capturing packets and filtering ARP traffic, etc.   Thank you again! ... View more

Hey @TranceforLife,   Our ISP has assigned us a block of /28 IP addresses. In my description I was trying to emphasize that I copied/mirrored the same settings on eth1/13 from eth1/1. As a result both interfaces have the same addresses assigned, just not at the same time.   In other words,  before pulling the copper line and installing the fiber I did the following to produce a valid configuration that would commit. After the following steps I pull copper and plug in optical. 1) Assign eth1/13 to same Security Zone as eth1/1 - that is L3-Untrusted. 2) Remove IP addresses AAA.BBB.CCC.34/28  &  AAA.BBB.CCC.37 and assign to eth1/13 3) Modify default-vr to include int1/13 and assign as interface to be used for the Default Route. 4) Move IKE Gatway interface assignment from eth1/1 to eth1/13   I do not own, manage, or have console access to the Cisco switch but could inquire with the NOC for any specific statistics if you have any suggestions.     Much appreciated. ... View more

This was the state of our fiber port yesterday before I abandoned ship and moved back over to copper on eth1/1     bob@pafw> show interface ethernet1/13 -------------------------------------------------------------------------------- Name: ethernet1/13, ID: 28 Link status: Runtime link speed/duplex/state: 1000/full/up Configured link speed/duplex/state: 1000/auto/auto MAC address: Port MAC address d4:f4:be:ab:cd:ef Operation mode: layer3 Untagged sub-interface support: no -------------------------------------------------------------------------------- Name: ethernet1/13, ID: 28 Operation mode: layer3 Virtual router default-vr Interface MTU 1500 Interface IP address: 17.22.113.34/28 17.22.113.37/32 Interface management profile: N/A Service configured: IKE Zone: L3-Untrusted, virtual system: vsys1 Adjust TCP MSS: no -------------------------------------------------------------------------------- -------------------------------------------------------------------------------- Physical port counters read from MAC: -------------------------------------------------------------------------------- rx-broadcast 0 rx-bytes 0 rx-multicast 0 rx-unicast 0 tx-broadcast 8 tx-bytes 512 tx-multicast 0 tx-unicast 0 -------------------------------------------------------------------------------- Hardware interface counters read from CPU: -------------------------------------------------------------------------------- bytes received 1614 bytes transmitted 336 packets received 13 packets transmitted 8 receive incoming errors 0 receive discarded 0 receive errors 0 packets dropped 0 -------------------------------------------------------------------------------- Logical interface counters read from CPU: -------------------------------------------------------------------------------- bytes received 1614 bytes transmitted 336 packets received 13 packets transmitted 8 receive errors 0 packets dropped 0 packets dropped by flow state check 0 forwarding errors 0 no route 0 arp not found 13 neighbor not found 0 neighbor info pending 0 mac not found 0 packets routed to different zone 0 land attacks 0 ping-of-death attacks 0 teardrop attacks 0 ip spoof attacks 0 mac spoof attacks 0 ICMP fragment 0 layer2 encapsulated packets 0 layer2 decapsulated packets 0 -------------------------------------------------------------------------------- bob@pafw>     ... View more

Thanks @reaper.  We have a Cisco 3400 fiber switch that  is our next hop from the 3020. Within the static-route tab of the default-vr I did not change the next hop.   Since the fiber switch remains as our next hop I don't believe anything is out of place with regard to  next hop configuration.   Appreciate the suggestions about clearing arp cache and checking arp stats! ... View more

Thanks for the reply @Roby_Sreejith. I confirmed before the switch over that the new fiber port ethernet1/13 had been assigned to the same seucurity zone, L3-Untrusted, as ethernet1/1 had been assigned to. ... View more