topic Re: What mean is 'no destination zone from forwarding' on global counters? in General Topics

What mean is 'no destination zone from forwarding' on global counters?

KiCheon.Lee — Wed, 27 Nov 2013 07:24:50 GMT

Hello,

I failed to install FWs to custom.

The FW was L3 mode with two interface(untrust , trust).

When I installed inline, from untrust traffic did not go through to trust.

Destination IP was just trust zone. In addition, FW did not have nat , vpn and protection configurations and security police was allow.

At that time, I found out strange traffic logs and global counters.

This traffic logs was source zone untrust , destination zone untrust , action allow , packet-received 897K and packet-sent 0.

Destination IP was included trust zone. but destination zone was utrust.

Also, 'no destination zone from forwarding' counter on global counters was increasing too many.

Please somebody help me for explain this traffic log and this counter.

Thanks.

Re: What mean is 'no destination zone from forwarding' on global counters?

gwesson — Fri, 29 Nov 2013 15:26:27 GMT

Every packet, including those that match an existing session, gets a route look-up. My recommendation is to ensure that there is a correct route for each IP in question:

> test routing fib-lookup virtual-router <VR_NAME> ip <IP_ADDRESS>

Do this for both directions, and ensure that the destination interface matches the correct zone. If not, you'll want to either add a static route, update whatever dynamic routing you use, or modify your interface zone configuration to ensure the destination on the return path is pointing to the correct zone.

Hope this helps,

Greg

Re: What mean is 'no destination zone from forwarding' on global counters?

mbutt — Mon, 02 Dec 2013 17:06:24 GMT

Seems like you are trying to allow traffic inbound from outside.

In that case the NAT will be untrust to untrust.

Following doc explains how to create destination NAT on page 15

https://live.paloaltonetworks.com/docs/DOC-1517

Hope this helps.

Regards,

Numan

Re: What mean is 'no destination zone from forwarding' on global counters?

KiCheon.Lee — Tue, 03 Dec 2013 02:57:32 GMT

Thanks Greg and Numan,

I had checked routing-table and fib-table but it is no problem.

And FW doesn't have NAT setting.

I have tested again on my lab.

This global count is increasing when interface down or no routing-table for destination ip.

Maybe, I look like wrong negotiation for speed and duplex when it happened.