To test this feature, visit your live site.

HA-Path-monitoring - VLAN-TAG-Vwire environment

HA - Path-monitoring - VLAN-TAG-Vwire environment

Hello good afternoon, as always thanks for the support and for the good will as always, it is much appreciated.

I have the following question:

Environment detail:

HA firewall, Vwire, with Vlan Tags by subinterfaces of a portchannel ( Ae1 ).

Is it possible to apply some kind of Path monitoring, to an environment, where vwire exists, but with the condition that it has vlan, tagged subinterfaces.

Reviewing this article, which is somewhat old, it indicates that in Vwire environments, of TAG of vlans, it is not possible:

live.paloaltonetworks.com

Path-Monitoring Virtual Wire

Hi everybody, PA-2050 Software: 3.0.5 we have configured a Cluster and want to use path monitoring over a Virtual Wire. The source IP must be an IP in the same subnet as the destination IP? We have implemented a Virtual Wire in a VLAN tagged environment. Is it possible to add an tag if we want t...

We need to monitor an IP, but the environment is as discussed above, vwire, tagged vl.

Thank you very much

Best regards

4 comments

Comments (4)

Reaper

Oct 06, 2022

Ehm. Yeah I don't see how that would work :)

MetgatzGR

Oct 06, 2022

Replying to

Yes, reviewing and looking at examples, it's like that IP source is somehow emulated, but it must be in the same subnet as the destination ip. In one of the live post it indicates that it is only valid for untagged traffic, but of course when it is vlan-tagged it is even more difficult for this to work correctly, but if it is an existing feature of high stick as ha-path monitoring vwire.

Reaper

Oct 06, 2022

Vwire does not have any IP connectivity to the network it's connected in, so you can't do path monitor You could consider layer2 interfaces so you can add a vlan interface to use as a source IP

MetgatzGR

Oct 06, 2022

Replying to

@Reaper

Yes, I totally agree.

But look at this, if it is possible, without having to set IP, but just using an IP inside the segment, but I don't know if this applies in vwire with tagged vlans.

-A Vwire Path is available-

Resolution

Which source IP address to use For "virtual wire" and VLAN interfaces, enter the source IP address as one of the unused IP addresses of the destination network to be used in the probe packets sent to the next-hop router (Destination IP address). The local router must be able to route the address to the firewall. The source IP address for path groups associated with virtual routers will be automatically configured as the interface IP address that is indicated in the routing table as the egress interface for the specified destination IP address.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail? id=kA10g000000ClrwCAC#:~: text=For%20virtual%20wire%20and%20VLAN%20interfaces%2C%20enter%20the%20source%20IP%20address%20as%20one%20of%20the%20unused%20IP%20addresses%20of%C2%A0the%20destination%20network%20to%20be%C2%A0used%20in%C2%A0the%20probe%20packets%20sent%20to%20the%20next%2Dhop%20router%20(Destination%20IP%20address).

live.paloaltonetworks.com

Path-Monitoring Virtual Wire

"The source IP must be an IP in the same subnet as the destination IP?

Yes, they need to be in the same subnet. Also remember that the source ip you use must be unique (no duplicate ips).

You asked:

Is it possible to add an tag if we want to use path monitoring in this environment, or is it only possible in untagged environments.

Currnetly it is not possible to add a tag for the path monitoring.

The traffic we are generating for the path monitoring is untagged....So this is only possible in an untagged environment."

Forum: Forum