1

I am a novice with PaloAlto networks. For testing purposes, I have connected two PA-220 with each other. I configured the IP addresses from the same subnet. For me, like routers, these devices should have see each other. I also configured any any allow policy rule. But i cant see any logs on Monitor tab, even hit count is zero. Is there anythin that i should configure?

PA1

PA1

PA2

PA2

Rules on both sides

Policy

PA1 config

config {
  mgt-config {
    users {
      admin {
        phash $1$qgtctsss$IFjK8.WW68yNGYlZ9ROtV.;
        permissions {
          role-based {
            superuser yes;
          }
        }
      }
      Simral {
        permissions {
          role-based {
            superuser yes;
          }
        }
        phash $1$jheglxtv$bjWiIYdQ9p0hG5azX2hDu.;
      }
    }
  }
  shared {
    application;
    application-group;
    service;
    service-group;
    botnet {
      configuration {
        http {
          dynamic-dns {
            enabled yes;
            threshold 5;
          }
          malware-sites {
            enabled yes;
            threshold 5;
          }
          recent-domains {
            enabled yes;
            threshold 5;
          }
          ip-domains {
            enabled yes;
            threshold 10;
          }
          executables-from-unknown-sites {
            enabled yes;
            threshold 5;
          }
        }
        other-applications {
          irc yes;
        }
        unknown-applications {
          unknown-tcp {
            destinations-per-hour 10;
            sessions-per-hour 10;
            session-length {
              maximum-bytes 100;
              minimum-bytes 50;
            }
          }
          unknown-udp {
            destinations-per-hour 10;
            sessions-per-hour 10;
            session-length {
              maximum-bytes 100;
              minimum-bytes 50;
            }
          }
        }
      }
      report {
        topn 100;
        scheduled yes;
      }
    }
  }
  devices {
    localhost.localdomain {
      network {
        interface {
          ethernet {
            ethernet1/2 {
              aggregate-group ae1;
            }
            ethernet1/3 {
              aggregate-group ae1;
            }
            ethernet1/5 {
              layer3 {
                ipv6 {
                  neighbor-discovery {
                    router-advertisement {
                      enable no;
                    }
                  }
                }
                ndp-proxy {
                  enabled no;
                }
                ip {
                  192.168.20.10;
                }
                lldp {
                  enable no;
                }
              }
            }
            ethernet1/6 {
              layer3 {
                ipv6 {
                  neighbor-discovery {
                    router-advertisement {
                      enable no;
                    }
                  }
                }
                ndp-proxy {
                  enabled no;
                }
                ip {
                  192.168.30.30;
                }
                lldp {
                  enable no;
                }
              }
            }
          }
          loopback {
            units;
          }
          vlan {
            units;
          }
          tunnel {
            units;
          }
          aggregate-ethernet {
            ae1 {
              layer3 {
                ipv6 {
                  neighbor-discovery {
                    router-advertisement {
                      enable no;
                    }
                  }
                }
                lacp {
                  high-availability {
                    use-same-system-mac {
                      enable no;
                    }
                  }
                  transmission-rate slow;
                  enable yes;
                  mode active;
                }
                ndp-proxy {
                  enabled no;
                }
                ip {
                  192.168.10.11;
                }
                lldp {
                  enable no;
                }
              }
              comment Link_To_PA1;
            }
          }
        }
        vlan;
        virtual-wire;
        profiles {
          monitor-profile {
            default {
              interval 3;
              threshold 5;
              action wait-recover;
            }
          }
          interface-management-profile;
        }
        ike {
          crypto-profiles {
            ike-crypto-profiles {
              default {
                encryption [ aes-128-cbc 3des];
                hash sha1;
                dh-group group2;
                lifetime {
                  hours 8;
                }
              }
              Suite-B-GCM-128 {
                encryption aes-128-cbc;
                hash sha256;
                dh-group group19;
                lifetime {
                  hours 8;
                }
              }
              Suite-B-GCM-256 {
                encryption aes-256-cbc;
                hash sha384;
                dh-group group20;
                lifetime {
                  hours 8;
                }
              }
            }
            ipsec-crypto-profiles {
              default {
                esp {
                  encryption [ aes-128-cbc 3des];
                  authentication sha1;
                }
                dh-group group2;
                lifetime {
                  hours 1;
                }
              }
              Suite-B-GCM-128 {
                esp {
                  encryption aes-128-gcm;
                  authentication none;
                }
                dh-group group19;
                lifetime {
                  hours 1;
                }
              }
              Suite-B-GCM-256 {
                esp {
                  encryption aes-256-gcm;
                  authentication none;
                }
                dh-group group20;
                lifetime {
                  hours 1;
                }
              }
            }
            global-protect-app-crypto-profiles {
              default {
                encryption aes-128-cbc;
                authentication sha1;
              }
            }
          }
        }
        qos {
          profile {
            default {
              class {
                class1 {
                  priority real-time;
                }
                class2 {
                  priority high;
                }
                class3 {
                  priority high;
                }
                class4 {
                  priority medium;
                }
                class5 {
                  priority medium;
                }
                class6 {
                  priority low;
                }
                class7 {
                  priority low;
                }
                class8 {
                  priority low;
                }
              }
            }
          }
        }
        virtual-router {
          default {
            protocol {
              bgp {
                enable no;
                dampening-profile {
                  default {
                    cutoff 1.25;
                    reuse 0.5;
                    max-hold-time 900;
                    decay-half-life-reachable 300;
                    decay-half-life-unreachable 900;
                    enable yes;
                  }
                }
              }
            }
            interface [ ae1 ethernet1/5 ethernet1/6];
          }
        }
      }
      deviceconfig {
        system {
          ip-address 192.168.1.1;
          netmask 255.255.255.0;
          update-server updates.paloaltonetworks.com;
          update-schedule {
            threats {
              recurring {
                weekly {
                  day-of-week wednesday;
                  at 01:02;
                  action download-only;
                }
              }
            }
          }
          timezone Asia/Baku;
          service {
            disable-telnet yes;
            disable-http yes;
          }
          hostname PA2;
          dns-setting {
            servers {
              primary 8.8.8.8;
              secondary 8.8.4.4;
            }
          }
          ntp-servers {
            primary-ntp-server {
              ntp-server-address time1.google.com;
              authentication-type {
                none;
              }
            }
          }
        }
        setting {
          config {
            rematch yes;
          }
          management {
            hostname-type-in-syslog FQDN;
          }
        }
      }
      vsys {
        vsys1 {
          application;
          application-group;
          zone {
            MGMT {
              network {
                layer3;
              }
            }
            Inside {
              network {
                layer3;
              }
            }
            Outside {
              network {
                layer3;
              }
            }
            DMZ {
              network {
                layer3;
              }
            }
            Interconnect {
              network {
                layer3 [ ae1 ethernet1/5 ethernet1/6];
              }
            }
          }
          service;
          service-group;
          schedule;
          rulebase {
            security {
              rules {
                Test {
                  to any;
                  from any;
                  source any;
                  destination any;
                  source-user any;
                  category any;
                  application any;
                  service application-default;
                  hip-profiles any;
                  action allow;
                }
              }
            }
          }
          import {
            network {
              interface [ ae1 ethernet1/5 ethernet1/6];
            }
          }
        }
      }
    }
  }
}

PA2 config

config {
  mgt-config {
    users {
      admin {
        phash $1$codxuhom$xXp//peldZrW.XwtJtgmn0;
        permissions {
          role-based {
            superuser yes;
          }
        }
      }
    }
    password-complexity {
      enabled yes;
      minimum-length 8;
    }
  }
  shared {
    application;
    application-group;
    service;
    service-group;
    botnet {
      configuration {
        http {
          dynamic-dns {
            enabled yes;
            threshold 5;
          }
          malware-sites {
            enabled yes;
            threshold 5;
          }
          recent-domains {
            enabled yes;
            threshold 5;
          }
          ip-domains {
            enabled yes;
            threshold 10;
          }
          executables-from-unknown-sites {
            enabled yes;
            threshold 5;
          }
        }
        other-applications {
          irc yes;
        }
        unknown-applications {
          unknown-tcp {
            destinations-per-hour 10;
            sessions-per-hour 10;
            session-length {
              maximum-bytes 100;
              minimum-bytes 50;
            }
          }
          unknown-udp {
            destinations-per-hour 10;
            sessions-per-hour 10;
            session-length {
              maximum-bytes 100;
              minimum-bytes 50;
            }
          }
        }
      }
      report {
        topn 100;
        scheduled yes;
      }
    }
  }
  devices {
    localhost.localdomain {
      network {
        interface {
          ethernet {
            ethernet1/2 {
              aggregate-group ae1;
            }
            ethernet1/3 {
              aggregate-group ae1;
            }
            ethernet1/5 {
              layer3 {
                ndp-proxy {
                  enabled no;
                }
                ip {
                  192.168.20.20;
                }
                lldp {
                  enable no;
                }
              }
            }
            ethernet1/6 {
              layer3 {
                ndp-proxy {
                  enabled no;
                }
                ip {
                  192.168.30.10;
                }
                lldp {
                  enable no;
                }
              }
            }
          }
          loopback {
            units;
          }
          vlan {
            units;
          }
          tunnel {
            units;
          }
          aggregate-ethernet {
            ae1 {
              layer3 {
                lacp {
                  high-availability {
                    use-same-system-mac {
                      enable no;
                    }
                  }
                  transmission-rate slow;
                  enable yes;
                  mode active;
                }
                ndp-proxy {
                  enabled no;
                }
                ip {
                  192.168.10.10;
                }
                lldp {
                  enable no;
                }
              }
            }
          }
        }
        vlan;
        virtual-wire;
        profiles {
          monitor-profile {
            default {
              interval 3;
              threshold 5;
              action wait-recover;
            }
          }
        }
        ike {
          crypto-profiles {
            ike-crypto-profiles;
            ipsec-crypto-profiles;
            global-protect-app-crypto-profiles {
              default {
                encryption aes-128-cbc;
                authentication sha1;
              }
            }
          }
        }
        qos {
          profile {
            default {
              class-bandwidth-type {
                mbps {
                  class {
                    class1 {
                      priority real-time;
                    }
                    class2 {
                      priority high;
                    }
                    class3 {
                      priority high;
                    }
                    class4 {
                      priority medium;
                    }
                    class5 {
                      priority medium;
                    }
                    class6 {
                      priority low;
                    }
                    class7 {
                      priority low;
                    }
                    class8 {
                      priority low;
                    }
                  }
                }
              }
            }
          }
        }
        virtual-router {
          default {
            protocol {
              bgp {
                enable no;
                dampening-profile {
                  default {
                    cutoff 1.25;
                    reuse 0.5;
                    max-hold-time 900;
                    decay-half-life-reachable 300;
                    decay-half-life-unreachable 900;
                    enable yes;
                  }
                }
              }
            }
            interface [ ae1 ethernet1/5 ethernet1/6];
          }
        }
      }
      deviceconfig {
        system {
          ip-address 192.168.1.1;
          netmask 255.255.255.0;
          update-server updates.paloaltonetworks.com;
          update-schedule {
            threats {
              recurring {
                weekly {
                  day-of-week wednesday;
                  at 01:02;
                  action download-only;
                }
              }
            }
          }
          timezone Asia/Baku;
          service {
            disable-telnet yes;
            disable-http yes;
          }
          hostname PA1;
          dns-setting {
            servers {
              primary 8.8.8.8;
              secondary 8.8.4.4;
            }
          }
          ntp-servers {
            primary-ntp-server {
              ntp-server-address time1.google.com;
              authentication-type {
                none;
              }
            }
          }
        }
        setting {
          config {
            rematch yes;
          }
          management {
            hostname-type-in-syslog FQDN;
          }
        }
      }
      vsys {
        vsys1 {
          application;
          application-group;
          zone {
            Outisde {
              network {
                layer3;
              }
            }
            Inside {
              network {
                layer3;
              }
            }
            DMZ {
              network {
                layer3;
              }
            }
            MGMT {
              network {
                layer3;
              }
            }
0

I don't think you able to the firewall traffic from the monitor page. the monitor page is dedicated to the traffic passing through the firewall. not generated from the firewall itself. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClU6CAK

| improve this answer | |
0

Dudes, thanks for your answers. Solved the problem. But I forgot to write here. I should have configured mgmt profile for pinging PA interface and besides that, I forgot to configure netmask.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.