CloudLabBox
Try the free demo

Palo Alto NGFW lab 29 of 30

Packet-flow troubleshooting: four tickets, four different drops

Four tickets, and none of them is a policy deny. Use filtered packet captures at each stage, global counters, the dataplane flow log, and the routing and NAT tests to find an asymmetric path, an MTU black hole, a NAT rule pointing at nothing and a forgotten blackhole route. Prove each cause from evidence, then fix it.

Run this lab

It needs Standard: its 5 nodes are set to 6 vCPU and 8,192 MB in total. That fits the free demo too.

In your workspace: Shared, then Palo Alto NGFW PAN-OS 11 guided labs, then 29 - Packet-flow troubleshooting - four tickets four different drops

Try it free for 30 minutesRun it on Standard from £5 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 75 minutes
Nodes need
6 vCPU, 8,192 MB
Smallest plan
Standard

The scenario

It's Monday, and a project team worked at the depot over the weekend. Four tickets have arrived:

  1. Ticket 1. The intranet on web01 (172.16.1.10) times out from Client-PC, though ping works.
  2. Ticket 2. Web pages on the internet load, but the 3 MB report at http://www.example.com/files/quarterly-report.bin hangs and never finishes.
  3. Ticket 3. The public site http://203.0.113.80 doesn't answer from the internet.
  4. Ticket 4. http://files.example.org/ has stopped working from Client-PC, while other internet sites work.

You've seen a plain policy deny in lab 23. None of these is one, so the traffic log won't help you much. The team has also been changing things in the network, not only on the firewall. Your job is to prove each cause with evidence from the firewall, and then fix it.

R2 is a small router the project team added between Inside and the DMZ. It forwards anything it receives, it has no firewall, and it isn't meant to carry user traffic.

Before you start. Start all the nodes. The firewall takes 6-8 minutes to boot and comes up with this lab's starting configuration already loaded. Wait until the FW1 console shows FW1 login:, then log in as admin / Lab-Access-1. Until the management plane is ready it answers Login incorrect, even with the right password. The Linux hosts are ready within seconds.

What you’ll practise

  • Choose capture filters that see both directions of a broken flow, including one the firewall has no session for
  • Identify asymmetric routing from captures and TCP counters
  • Diagnose an MTU black hole, and fix it with MSS adjustment and working ICMP
  • Trace a destination NAT fault through ARP and the forwarding counters
  • Read the dataplane flow log, and use the routing and NAT test commands

The tasks

  1. Set up your tools
  2. Ticket 1, the intranet times out
  3. Ticket 2, the download hangs
  4. Ticket 3, the public site
  5. Ticket 4, the missing file server
  6. Commit and close the tickets

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Packet-flow troubleshooting - four tickets four different drops5 nodes and 3 networks, 9 links. Every link is listed as text below the diagram.FW1Client-PCweb01InternetR2InsideOutsideDMZeth0ethernet1/3eth0mgmtethernet1/2eth0ethernet1/1eth1eth0
5 nodes and 3 networks, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • FW1 mgmt to Inside (network)
  • FW1 ethernet1/1 to Outside (network)
  • FW1 ethernet1/2 to Inside (network)
  • FW1 ethernet1/3 to DMZ (network)
  • Client-PC eth0 to Inside (network)
  • web01 eth0 to DMZ (network)
  • Internet eth0 to Outside (network)
  • R2 eth0 to Inside (network)
  • R2 eth1 to DMZ (network)
Nodes in Packet-flow troubleshooting: four tickets, four different drops, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
FW1Palo Alto Networks VM-Series (PAN-OS)paloalto-11.2.52 vCPU, 5,632 MB
Client-PCEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
web01EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 512 MB
InternetEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 512 MB
R2EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Palo Alto NGFW PAN-OS 11 guided labs.

  3. Open 29 - Packet-flow troubleshooting - four tickets four different drops and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Palo Alto NGFW labs

All Palo Alto NGFW labs

Related labs in other courses

CloudLabBox is independent of Palo Alto Networks and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.