On PA VM unable to change service route configuration to select another interface for example eth1

[fatboy1607]

On PA VM unable to change service route configuration to select another interface for example eth1

VM 8.1.6-H2

[jmeurer]

You need to assign a static IP address to the Interface before it can be used as a service route.  Just ensure you use the same IP as what is assigned by the cloud provider.

[fatboy1607]

Problem is I cannot change it to static as it needs to stop VM to do that ? would it be possibel to change it to static without rebooting VM ?

Secondly I dont understand why my firewall is using public ip to communicate with DC even though I have private ip assigned on management interface

[jmeurer · Accepted solution]

You do not need to reboot to assign a static in the Firewall GUI, you leave the assignment as is on the EC2 side.  You just need to assign that IP in the firewall GUI as a static.  I cannot guarantee that it will not be traffic impacting though as it works through the DHCP release during the commit.

As for your second question, that comes down to how your VPC routing is configured.  Traffic leaves the Firewall Mgmt interface on its private IP, if VPC routing sends the traffic to an IGW or NatGW, the fabric will then SNAT to the assigned EIP.  If you have a route pointing to on prem via a DX or VGW, then the traffic should remain private.