topic Re: Application Override Policy Match Criteria, does it match on Pre or Post-NAT Zone/IP? in General Topics

Application Override Policy Match Criteria, does it match on Pre or Post-NAT Zone/IP?

Smi12 — Thu, 12 Dec 2013 14:23:58 GMT

Hello

I'm currently configuring a PA-2050 running PAN 5.0.9

Can anyone confirm if the Application Override Policy match criteria should be configured to match on the Pre-NAT or Post-NAT zones and IP addresses. I'm assuming it will match in the same way as a security policy does, and use the Post-NAT Zone, while the IP address match is based upon the Pre-NAT original packet destination?

I've just read the PAN 5.0 Admin Guide and it makes no mention of the Application override match criteria with regard to NAT and neither does .

Any help would be appreciated, thanks in advance.

Re: Application Override Policy Match Criteria, does it match on Pre or Post-NAT Zone/IP?

dpalani — Thu, 12 Dec 2013 18:30:48 GMT

Hi,

The application override must behave like a security policy and it is parsed after the nat rule is parsed. Therefore your rule must have zones and ips similar to the security rule.

Deepak

Re: Application Override Policy Match Criteria, does it match on Pre or Post-NAT Zone/IP?

hyadavalli — Sat, 14 Dec 2013 14:38:57 GMT

Hello Smi,

Please take a look at below document explaining about packet flow in panos.

https://live.paloaltonetworks.com/docs/DOC-1628

Regards,

Hari Yadavalli