aws-transit-vpc
aws-transit-vpc copied to clipboard
PaloAltoNetworks
Firewall stopped responding
After a day or so, the firewall stop responding to their public ip address. I rebooted one of the instances in AWS and was still unable to connect via web or ssh. Also, once i rebooted the one instance, the VPN tunnel on the AWS side wouldn't come up. Help?
If you are still having the issue go into the firewall cli and run the following commands show session all filter application ipsec show session all filter application ike
these commands may not be exact but you are basically checking to see if the firewall still has a session up for the either phase 1 or phase 2 tunnel. Some times during a sudden drop the firewall will have a session up and when the VPN Peer tries to connect to the firewall it will not work. It will match on the source ip and dest ip and protocol but nothing else. This is one possibility to look at.
Thanks, but I can't access the firewalls at all. I even rebooted the firewall instance, which didn't help.
Got. I am aware that you rebooted but try powering them completely off. Once they are completely off power them back up.
If that doesn't work is there anyone in their making changes beside yourself?
You can look at the console output and do a screenshot as well to see what it says. It should at least be at the VM login screen. If someone made a change to a security group or set a route to use something other than the IGW then it could also cause this type of issue if the configuration isn't precise.
Instead of rebooting from the VM itself, go to the AWS console, stop your instance then start it again. By stopping and restarting from the console, AWS will relocate your VM to a different host. That may help. I had a similar issue than yours and this is how I resolved it. I guess sometimes AWS is doing some maintenance on their hardware that may impact a VM.
Thanks for pointing that out @sturmblade because when I was saying power off I meant by the console also. But since there is no mgmt access there is no other way to power off but via console.