About trees

Hey Guys and Gals   I am having an issue getting u-turn nat to work between two isolated networks on the same Palo.  I am basically tiring to allow Interanal clients to access a webcam server in a IoT network.  I think might issue might be that I need to add a Statement in my Virtual Route or a Policy Based Routing rule. Though the reality is that I probable made a simple error like putting in the wrong zone somewhere.  Both network live on a Palo Alto running Pan OS 8.1.  I've include a diagram and config below, the names and address have been changed to protect the innocent.  I add because I realize that the internal address might not be clear on the diagram.  10.0.x.254 is the internal ip address of the Palo Alto.  The internal gateway is 10.0.x.1.  I appreciate any help or insight people can provide, and I hope I provided enough information. Nat Policy Original Packet Tab Source Zone = Corp Trust, Destination Zone = IoT Untrust, Destination Interface is Any, Service is TCP port 8889, Source Address = Any, Destination Address = 1.1.1.2  Translated Packet Tab Source Address Tranlation = Translation Type is Dynamic IP and Port, Address type is Interface Address, Interface is 2, Destination Address Translation = Translation Type is Static IP, Translation Address is 10.0.10.200, translation port is 443   Security Policy Source Zone is Corp Trust, Source Address is Any, Destination Zone is IoT Untrust, Destination address is 1.1.1.2, Service is 443, Action is Allow.   Virtual Routes Corp Static Route Destination 0.0.0.0/0 next hop 1.1.1.1 Destination 10.0.0.0/24 next hop 10.0.0.1   Virtual Route IoT Destination 0.0.0.0/0 next hop 1.1.1.2 Destination 10.0.10.0/24 next hop 10.0.10.1   ... View more

I have a network with in my network that I am trying to control access with user-id in the palo alto.  Before I can do this I need to get routing working.  The routing works just fine up to the palo alto in my test environment.  Each interface can talk to the next hop on the otherside but traffic isn't routing across the interfaces.  I can not ping source 192.168.111.10 to 192.168.2.1  but I can ping source 192.168.111.10 to 192.168.111.1. This is the same for all interfaces.   Here is a copy of my routing table VIRTUAL ROUTER: TEST (id 15) ========== destination nexthop metric flags age interface next-AS 192.168.0.0/16 192.168.2.1 15 A S ethernet1/3.9514 192.168.3.0/24 192.168.3.251 0 A C ethernet1/3.9514 192.168.3.251/32 0.0.0.0 0 A H 192.168.111.0/24 192.168.111.1 10 S ethernet1/4.9509 192.168.111.0/24 192.168.111.10 0 A C ethernet1/4.9509 192.168.111.10/32 0.0.0.0 0 A H 192.168.112.0/24 192.168.112.1 10 S ethernet1/4.9510 192.168.112.0/24 192.168.112.10 0 A C ethernet1/4.9510 192.168.112.10/32 0.0.0.0 0 A H total routes shown: 9   Here is how the layer 3 interface is setup -------------------------------------------------------------------------------- Name: ethernet1/3.9514, ID: 265 Operation mode: layer3 Virtual router TEST Interface MTU 1500 Interface IP address: 192.168.3.251/24 Interface management profile: Default ping: yes telnet: no ssh: no http: no https: no snmp: no response-pages: no userid-service: yes Service configured: Interface belong to same subnet as management interface: Yes Zone: TEST_Untrust, virtual system: vsys1 Adjust TCP MSS: no -------------------------------------------------------------------------------- -------------------------------------------------------------------------------- Name: ethernet1/4.9509, ID: 266 Operation mode: layer3 Virtual router TEST Interface MTU 1500 Interface IP address: 192.168.111.10/24 Interface management profile: Default ping: yes telnet: no ssh: no http: no https: no snmp: no response-pages: no userid-service: yes Service configured: Zone: TEST_Trust, virtual system: vsys1 Adjust TCP MSS: no -------------------------------------------------------------------------------- -------------------------------------------------------------------------------- Name: ethernet1/4.9510, ID: 267 Operation mode: layer3 Virtual router TEST Interface MTU 1500 Interface IP address: 192.168.112.10/24 Interface management profile: Default ping: yes telnet: no ssh: no http: no https: no snmp: no response-pages: no userid-service: yes Service configured: Zone: TEST_Trust, virtual system: vsys1 Adjust TCP MSS: no --------------------------------------------------------------------------------  Here are the security policy associated with virtual routes and interfaces   "Inbound TEST untrust to trust" { from TEST_Untrust; source any; source-region none; to TEST_Trust; destination any; destination-region none; user any; category any; application/service any/any/any/any; action allow; icmp-unreachable: no terminal yes; } "Outbound TEST trust to untrust" { from TEST_Trust; source any; source-region none; to TEST_Untrust; destination any; destination-region none; user any; category any; application/service any/any/any/any; action allow; icmp-unreachable: no terminal yes; }   Any help or advice would be greatly apreciated.  I have concidered using a virtual wire but now I really just want to figure this out after spending a day on it with no success. -Michael ... View more