On PA VM unable to change service route configuration to select another interface for example eth1

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

On PA VM unable to change service route configuration to select another interface for example eth1

L4 Transporter

On PA VM unable to change service route configuration to select another interface for example eth1

 

VM 8.1.6-H2

SD-WAN | Cloud Networking | PCNSE | ICSI CNSS | MCNA | | CCNP | CCSA | SPSP | SPSX | F5-101 |
1 accepted solution

Accepted Solutions

You do not need to reboot to assign a static in the Firewall GUI, you leave the assignment as is on the EC2 side.  You just need to assign that IP in the firewall GUI as a static.  I cannot guarantee that it will not be traffic impacting though as it works through the DHCP release during the commit.

 

As for your second question, that comes down to how your VPC routing is configured.  Traffic leaves the Firewall Mgmt interface on its private IP, if VPC routing sends the traffic to an IGW or NatGW, the fabric will then SNAT to the assigned EIP.  If you have a route pointing to on prem via a DX or VGW, then the traffic should remain private.

View solution in original post

3 REPLIES 3

L4 Transporter

You need to assign a static IP address to the Interface before it can be used as a service route.  Just ensure you use the same IP as what is assigned by the cloud provider.

Problem is I cannot change it to static as it needs to stop VM to do that ? would it be possibel to change it to static without rebooting VM ?

 

Secondly I dont understand why my firewall is using public ip to communicate with DC even though I have private ip assigned on management interface

SD-WAN | Cloud Networking | PCNSE | ICSI CNSS | MCNA | | CCNP | CCSA | SPSP | SPSX | F5-101 |

You do not need to reboot to assign a static in the Firewall GUI, you leave the assignment as is on the EC2 side.  You just need to assign that IP in the firewall GUI as a static.  I cannot guarantee that it will not be traffic impacting though as it works through the DHCP release during the commit.

 

As for your second question, that comes down to how your VPC routing is configured.  Traffic leaves the Firewall Mgmt interface on its private IP, if VPC routing sends the traffic to an IGW or NatGW, the fabric will then SNAT to the assigned EIP.  If you have a route pointing to on prem via a DX or VGW, then the traffic should remain private.

  • 1 accepted solution
  • 3991 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!