topic Destination Zone in General Topics

Destination Zone

didier.bonato — Fri, 21 Jan 2022 06:02:23 GMT

Hello

I found in documentation : "Assign destination zone based on Interface packet would egress from"

What is behind this "would" ? How is choose the destination zone , based on FW topology or routing table or ?

I have set a route (next hop Tunnel interface) to a subnet and a NAT rule.

I have a traffic from 2 differents source zone but same destination.

In log, destination zone is not the same for each traffic;

My rules are working but I can't explain why.

So how is based the choice for the destination zone ?

Thanks in advance

Re: Destination Zone

OtakarKlier — Fri, 21 Jan 2022 19:27:24 GMT

Hello,

As for the logs, enable logging at session end on all polcies and then check the traffic logs to see what they say. As for egress zone, its where the traffic is going or where it will end up. Each interface must be assigned a zone, where the packets leaves the firewall interface, that would be the egress zone based on the interface.

Regards,

Re: Destination Zone

didier.bonato — Mon, 24 Jan 2022 07:57:34 GMT

Hello

Thanks for your reply.
My question is not : how i can check the destination zone but how PAN OS set it ?

After checking routing table or depending on the topology of firewall or something else ?

Regards

Re: Destination Zone

Raido_Rattameister — Mon, 24 Jan 2022 14:09:27 GMT

Destination zone is decided based on routes in virtual router so yes routing table.

If you have Policy Based Forwarding rules that overlap with virtual router then PBF route will take precedence over virtual router.