topic Policy in General Topics

Policy

Sujanya — Fri, 20 Jan 2023 12:58:48 GMT

Hi All,

Can we configure a single policy , giving user-id's and few different IP address as source.

Will both mentioned user id's and IP address are able reach the destinations which was allowed.

Re: Policy

Raido_Rattameister — Fri, 20 Jan 2023 14:30:41 GMT

You can use both username field and source IP field filled in same rule.

Let's assume you have users John and Mary in username field and IPs 192.168.1.5 and 192.168.1.20 IPs in source IP field.

This means that traffic from users John or Mary will match to the rule if their IP is either 192.168.1.5 or 192.168.1.20

So if you look at the security policy page there is "OR" between items in same column and "AND" between columns.

Source user is either John OR Mary with source IP either 192.168.1.5 OR 192.168.1.20

Re: Policy

OtakarKlier — Fri, 20 Jan 2023 22:48:36 GMT

Hello,

I would recommend two policies. One that has the User-id's and another that has the source IP's. The way the Palo Alto reads policies is top to bottom and left to right. So if you have a policy with both user-id's and source IP's, both conditions must exist.

Hope that helps.

Re: Policy

Sujanya — Wed, 25 Jan 2023 12:59:57 GMT

Thanks @OtakarKlier , @Raido_Rattameister for giving the clarity.