Network Management

 View Only
Expand all | Collapse all

Configuring a 2930M switch with Palo Firewall

This thread has been viewed 40 times
  • 1.  Configuring a 2930M switch with Palo Firewall

    Posted Feb 08, 2023 12:27 AM
    Dear Friends, 

    I was trying to build a testing network at home with a Switch 2930M.

    Now I have got all basic things working. However, I cannot ping other vlan interfaces. I logged with SSH from my Computer: 192.168.0.91. Palo firewall is: 192.168.0.1 

    Seems everything with vlan 10 is working. However, I cannot ping anything else. I got the internet from PALO as well... Can you help me figure out why? I have attached show ip route as well. ...

    here is my command: 

    hostname "Larryswitch"

    module 1 type jl320a

    flexible-module A type JL083A

    console idle-timeout 3600

    console idle-timeout serial-usb 3600

    no telnet-server

    ip dns server-address priority 1 192.168.0.55

    ip dns server-address priority 2 10.8.0.1

    ip route 10.8.0.0 255.255.255.0 192.168.0.1

    ip route 10.32.0.0 255.255.255.0 192.168.0.1

    ip route 192.168.0.0 255.255.255.0 192.168.0.1

    ip routing

    ip source-interface radius vlan 10

    oobm

       ip address dhcp-bootp

       exit

    vlan 1

       name "DEFAULT_VLAN"

       no untagged 1,3-10,13

       untagged 2,11-12,14-24,A1-A4

       ip address dhcp-bootp

       exit

    vlan 10

       name "Server"

       untagged 3-10

       ip address 192.168.0.254 255.255.255.0

       exit

    vlan 20

       name "Management"

       ip address 10.32.0.1 255.255.255.0

       exit

    vlan 30

       name "home"

       untagged 1,13

       ip address 10.8.0.254 255.255.255.0

       exit

    no tftp client

    no tftp server

    password manager

    password operator


    Larryswitch(config)# show ip route

                                                                 IP Route Entries

      Destination        Gateway         VLAN Type      Sub-Type   Metric     Dist.

      ------------------ --------------- ---- --------- ---------- ---------- -----

      10.8.0.0/24        192.168.0.1     10   static               1          1    

      10.32.0.0/24       192.168.0.1     10   static               1          1    

      127.0.0.0/8        reject               static               0          0    

      127.0.0.1/32       lo0                  connected            1          0    

      192.168.0.0/24     Server          10   connected            1          0    

    Any idea please? Do I need to configure Palo's virtual router or NAT as well? 

    Thanks,
    Nameless



  • 2.  RE: Configuring a 2930M switch with Palo Firewall

    Posted Feb 08, 2023 09:05 AM
    Do you want to route traffic between the VLANs 10,20,30 on the switch? Or on the firewall?
    Also it looks like none of the ports in vlan 20,30 (no port assigned in VLAN20!; port 1,3 vlan 30) are up, so you can't reach anything in those subnets.
    And there is no default route (0.0.0.0/0) which normally would go to the firewall (and internet with NAT after that). And the firewall should have a route back to the VLANs 20,30. Note that a VLAN (and it's interface) will be down/unaccessible if there is no interface up that is configured for that VLAN; which means you can't even ping the switch IP in those VLANs.

    If you are not familiar with IP routing, this 'let's build a network' video series may get you started.

    Personally, I would create VLANs on the firewall and do the routing there so you can put firewall policies between server-mgmt-home; but if you don't need firewalling between those subnets you can do the ip forwarding on the switch as well, then make sure you have the return route on the firewall and a defaut route from switch to firewall.

    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------



  • 3.  RE: Configuring a 2930M switch with Palo Firewall

    Posted Feb 08, 2023 06:24 PM
    Edited by manly009 Feb 08, 2023 06:23 PM

    Hi Herman, 

    Thanks so much for the answer.

    I figured out that I need to get a device on the vlan to be able to ping....DAH....

    Also, I want all vlan to be able to route to each other with worrying configuring route and NAT on Firewall. 

    I used IP routing. Now, I can only ping the VLAN getway, for example, I can ping vlan 30 gateway 10.8.0.254, but I cannot ping a device in that vlan by its IP 10.8.0.10. However, I can ping both from the switch. What possibly did I configure wrong? 

    Thanks

    ML




  • 4.  RE: Configuring a 2930M switch with Palo Firewall

    Posted Feb 08, 2023 11:27 PM

    I do not know why I replied...But cannot see any reply/??? Did you see my reply? 

    Any let me try again..




  • 5.  RE: Configuring a 2930M switch with Palo Firewall

    Posted Feb 08, 2023 11:28 PM

    Hi Herman, 

    Thanks so much for the answer.

    I figured out that I need to get a device on the vlan to be able to ping....DAH....

    Also, I want all vlan to be able to route to each other with worrying configuring route and NAT on Firewall. 

    I used IP routing. Now, I can only ping the VLAN getway, for example, I can ping vlan 30 gateway 10.8.0.254, but I cannot ping a device in that vlan by its IP 10.8.0.10. However, I can ping both from the switch. What possibly did I configure wrong? 

    Thanks

    ML




  • 6.  RE: Configuring a 2930M switch with Palo Firewall

    Posted Feb 08, 2023 11:29 PM

    Also, 

    Also, is it unnecessary to run this: 

    ip route 0.0.0.0 0.0.0.0 10.0.0.5
    ip route 10.0.5.0 255.255.255.0 10.0.0.5 name "VPN"
    ip route 172.31.0.0 255.255.255.252 10.0.0.5 name "PaloAlto"

    Since ip route 0.0.0.0 0.0.0.0 10.0.0.5 will include all subnet forwarding to 10.0.0.5? 

    Thanks




  • 7.  RE: Configuring a 2930M switch with Palo Firewall

    Posted Feb 09, 2023 06:34 AM

    Hi, correct.

    When you configure the RoLR (Route of Last Resort) to a NHG (Next Hop Gateway) by issuing the ip route 0.0.0.0 0.0.0.0 <NHG-IP-Address> your are saying that any net with any mask destination (excluded your directly connected networks) can be reached via the NHG IP Address.

    If 10.0.5.0 and/or 172.31.0.0 are networks routed by (or reachable through your) Firewall - which is the NHG for any other network - the RoLR takes care of that.




  • 8.  RE: Configuring a 2930M switch with Palo Firewall

    Posted Feb 09, 2023 05:20 PM

    Hi parnassus,

    Thanks for your help. 

    How can I get Intravlan reachable to each other without going through the Firewall ( gateway ) ? Donot use static route ip route 0.0.0.0 0.0.0.0 10.0.0.5 ? 

    Thanks

    ML




  • 9.  RE: Configuring a 2930M switch with Palo Firewall

    Posted Feb 09, 2023 06:43 PM
    By enabling ip routing on your Aruba 2930M.

    I suppose that each VLAN Id defined into (and used by) your Aruba 2930M will be configured with an IP address (SVI). Edge devices belonging to a particular VLAN shall use the relevat VLAN IP address (SVI) as their default gateway (indeed your Aruba 2930M is going to be the router for its VLANs and each VLAN will be tied to a particular network segment).

    A discussion about how to made the Firewall and your routing switch to interact each other would also be possible (Routing through a Transit VLAN between the two or just letting - as it probably happens now - your Firewall to have its LAN interface directly connected in Layer 2 with a particular VLAN Id of your Aruba 2930M?) but that is just the next step for a robust setup.





  • 10.  RE: Configuring a 2930M switch with Palo Firewall

    Posted Feb 10, 2023 12:24 AM

    Now I really cannot figure out what is going with my core switch, I can ping anything from the core switch,,I just cannot ping from 192.168.0.55 (DNS server) to any other ranges except  vlans gateway, for exmaple, once I have a mchine on 10.32.0.10, the dns server can ping 10.32.0.1, but cannot ping 10.32.0.10.... From 10.32.0.10, I can ping 192.168.0.254 (Gateway), but I cannot ping 192.168.0.55 or something else.....

    PA trust interface: 192.168.0.1

    Running configuration:

    hostname "Larryswitch"

    module 1 type jl320a

    flexible-module A type JL083A

    console idle-timeout 3600

    console idle-timeout serial-usb 3600

    radius-server host 192.168.0.55 key ""

    radius-server host 192.168.0.55 dyn-authorization

    radius-server host 192.168.0.55 time-window 0

    no telnet-server

    telnet-server listen data

    web-management listen data

    ip dns server-address priority 1 192.168.0.55

    ip dns server-address priority 2 8.8.8.8

    ip ssh filetransfer

    ip ssh listen data

    ip route 0.0.0.0 0.0.0.0 192.168.0.1

    ip routing

    ip source-interface radius vlan 10

    key-chain ""

    snmp-server community "public" unrestricted

    snmp-server listen data

    aaa authentication num-attempts 2

    aaa authentication login privilege-mode

    aaa authentication web login peap-mschapv2 local

    aaa authentication web enable peap-mschapv2 local

    aaa authentication ssh login peap-mschapv2 local

    aaa authentication ssh enable peap-mschapv2 local

    aaa authentication port-access chap-radius

    aaa port-access authenticator 1 tx-period 10

    aaa port-access authenticator 1 client-limit 2

    aaa port-access authenticator active

    oobm

       disable

       ip address dhcp-bootp

       exit

    vlan 1

       name "DEFAULT_VLAN"

       no untagged 3-10,13-16,18

       untagged 1-2,11-12,17,19-24,A1-A4

       ip address dhcp-bootp

       exit

    vlan 10

       name "management"

       untagged 3-10

       ip address 192.168.0.254 255.255.255.0

       exit

    vlan 20

       name "Wifi"

       untagged 15-16,18

       ip address 10.32.0.1 255.255.255.0

       ip helper-address 192.168.0.55

       exit

    vlan 30

       name "HomeUse"

       untagged 13-14

       ip address 10.30.0.1 255.255.255.0

       ip helper-address 192.168.0.55

       exit

    management-vlan 10

    no tftp client

    no tftp server

    tftp server listen data

    password manager

    password operator

    Show IP: 

    Internet (IP) Service

      IP Routing : Enabled

      Default TTL     : 64   

      Arp Age         : 20 

      Domain Suffix   :                               

      DNS server      : 192.168.0.55                            

                           |                                            Proxy ARP

      VLAN                 | IP Config  IP Address      Subnet Mask     Std  Local

      -------------------- + ---------- --------------- --------------- ----------

      DEFAULT_VLAN         | DHCP/Bootp

      management           | Manual     192.168.0.254   255.255.255.0    No    No

      Wifi                 | Manual     10.32.0.1       255.255.255.0    No    No

      HomeUse              | Manual     10.30.0.1       255.255.255.0    No    No

    SHow vlan: 

    show vlan      

    Status and Counters - VLAN Information

      Maximum VLANs to support : 256                  

      Primary VLAN : DEFAULT_VLAN

      Management VLAN : DEFAULT_VLAN

      VLAN ID Name                             | Status     Voice Jumbo

      ------- -------------------------------- + ---------- ----- -----

      1       DEFAULT_VLAN                     | Port-based No    No   

      10      management                       | Port-based No    No   

      20      Wifi                             | Port-based No    No   

      30      HomeUse                          | Port-based No    No 

    Any idea why? 

    Thanks,
    ML




  • 11.  RE: Configuring a 2930M switch with Palo Firewall

    Posted Feb 10, 2023 02:23 AM
    Give this command a try first:

    no management-vlan 10

    because you should not desire to use the VLAN id 10 as the isolated Management VLAN (a Management VLAN doesn't partecipate to routing).

    In your scenario indeed we suppose that the VLAN 10 should act just like all others VLANs you defined (VLAN 20 and 30). Isn't it?

    Then be sure hosts you use to test pings don't have OS Firewall blocking incoming ICMP...this happens quite often.

    If:

    1 - VLAN 10 has 192.168.0.254
    2 - VLAN 20 has 10.32.0.1
    3 - VLAN 30 has 10.33.0.1
    4 - ip routing is enabled on the Switch

    and hosts belonging to - say - VLAN 20 are correctly addressed on their 10.32.0.0/24 network segment (using proper GW 10.32.0.1 address) and all other hosts involved in your tests are correctly addressed into their respective VLAN too THEN you are good (I expect that the VLAN tagging membership - thus applying native VLAN aka untagging to ports where you connect your pc/servers - is correctly assigned to edge ports used by your various hosts).







  • 12.  RE: Configuring a 2930M switch with Palo Firewall

    Posted Feb 12, 2023 08:12 PM

    hi David, 

    Yes, I removed Management VLAN 10. All good. As default, should I put Native VLAN to Management VLAN or just leave Management VLAN empty? What would be the best practise? 

    Thanks

    ML




  • 13.  RE: Configuring a 2930M switch with Palo Firewall

    Posted Feb 13, 2023 02:36 AM
    Management VLAN (which should not to be confused with a VLAN associated with a network segment where you decided to place management IP addressed of various network devices, eventually not only switches) has the characteristic of being not routable compare to all others VLAN types (indeed it does not partecipate to routing...so the term "isolated" I used above).

    Its usage is related to your network topology (I mean: generally it could be used where there is an OoBM network kept separated from frontend networks...) so it's hard to tell if should/shouldn't be used.

    If you don't use it but you don't want to renounce to routing for the particular VLAN used to host network devices' management interfaces (OoBM or not) then you would try the implementation of ACLs to segregate (protect) that segment.