Elastic IP's not responding on Palo Alto VM

[Gregman380]

Greetings All,

I have a very basic question and basic issue.  I have Palo Alto up and running in my lab on AWS.  I can connect to the Management Interface just fine.  I have added eth1 to the the PA and configured the access for ping, ssh, https, etc. Also created the zone.  I am using the default virtual router. 

From within my VPC using another Linux instance I can ping the private IP address on eth1, but I cannot ping the elastic IP address that is associated with that eni from the internet.  I can ping the Management public address but not anything I add to eth1, eth2, etc.  I am just out of ideas!!

Any help would be really appreciated!

Greg

[Warby · Accepted solution]

Hi Greg,

This should work and is supported.  I've done this myself with no issues.  Here are some things to try:

• double check your AWS security group for that ENI
• double check your subnet route
  • if this ENI is on a different subnet then the management ENI, does that other subnet have an IGW route?
• SSH in and run the command: show counter global filter delta yes
  • then launch your ping to the EIP and repeat the command above
  • look for any drops
• as a last resort, override your default inter and intra security policy rules and turn on start/stop logging
  • watch the traffic log

HTH,

Warby

[Gregman380]

Thank you for the feedback.  Yes the ping is being denied according to the intrazone rule.  I have a management rule that allows ping set up and applied to that interface.  It should accept ping...

Thank you again!

[Gregman380]

Ok, well based on what you told me I think I may have been blocking myself!!  It is working now and I thank you for your response.  I learned some good troubleshooting along the way!!

Best Regards,

Greg

[p.manojkumar]

Hi Warby,

I have this similar issue with Paloalto external interface elastic ip not reachable from internet

but mgmt EIP is reachable

Verified security group allow all traffic & enabled https

Any idea?

Thanks

Manoj

[Aashish1]

Hi Manoj ,

Please check the security group assigned to the public interface . Make sure all the traffic from 0.0.0.0/0 is allowed on all ports initalially while testing.