topic Re: Statefull or not statefull in General Topics

Statefull or not statefull

awarsame — Sun, 30 Jun 2013 13:05:14 GMT

We recently purchase pa3020s for mainly application control reason and put them behind cisco ASAs. I set up trust-to -untrust policy which applies to outbound internet traffic. I denied unwanted apps and allowed rest using user group mapping. that is all working fine and users can access internet with no problem..

well, last week, I tried to do the same to default untrust-to-trust policy to the Inbound traffic. I created a policy that allowed the DMZ and remote VPN traffic coming through the ASA and I changed the default untrust -to-trust policy from allow to deny. The result was internet access stopped. No one could access Internet and I had to back the change out.

My thinking was that this a state full firewall and for any outbound traffic, the return traffic should pass through if it matches a established session. is this not right with PA firewall? do they do statefull inspection or not?

thank you

Re: Statefull or not statefull

Retired Member — Sun, 30 Jun 2013 16:44:05 GMT

Hi,

Palo Alto is statefull by default.Do you have 1 cisco ASA or 2 cisco ASAs on that topology.

Are they active passive or active active ?

You should examine the logs related to the clients so that you will see what happened during that config.

Re: Statefull or not statefull

kprakash — Mon, 01 Jul 2013 13:14:30 GMT

Are the PANFWs in Layer3 mode or in vwire mode?

Can you attach the sceenshot of the untrust to trust rule on the PANFW

Thanks and best regards,

Karthik RP

Re: Statefull or not statefull

awarsame — Mon, 01 Jul 2013 14:18:43 GMT

I have 2 ASA active/standby same as PAs. PAs are in vwire mode. let me try it again and I check logs closely or post them here.

Thank you all for the input.

Re: Statefull or not statefull

awarsame — Tue, 02 Jul 2013 12:51:43 GMT

I discovered what issue was. It was an error on my part on how I configured the policy. thank you all.

Re: Statefull or not statefull

NickySorot — Thu, 07 May 2015 10:51:36 GMT

H Team,

is there any document available PA 3020 is statefull?

Pls share link to download.

Re: Statefull or not statefull

jdelio — Thu, 07 May 2015 16:26:13 GMT

NickySorot, As was stated before, All Palo Alto Networks firewalls are stateful by default.

If you require something specific, please let us know.

Re: Statefull or not statefull

NickySorot — Mon, 11 May 2015 13:07:04 GMT

ok thanks. can you share document link to proof that this is statefull.

one more question: can we assign multiple segment on one interface.

ex: 192.168.1.0 to 192.168.1.32

192.168.1.33 to 192.168.1.64

Re: Statefull or not statefull

aabdelhali — Mon, 11 May 2015 14:02:57 GMT

NickySorot

The information that you are looking for can be found on this link,

https://www.paloaltonetworks.com/resources/learning-center/what-is-a-firewall.html

Amjad

Re: Statefull or not statefull

jdelio — Mon, 11 May 2015 15:59:23 GMT

Nicky, the link was posted about being stateful.

as far as the multiple segments. You can place as many IP addresses as you want to an interface.

It looks like you want a "range".. do you mind if I ask why you are wanting to do that? For what purpose? NAT?

Re: Statefull or not statefull

NickySorot — Tue, 12 May 2015 05:27:59 GMT

i want to create multiple logical networks like a group of 30 hosts and wants to keep separate logically. like to allow access based on policy between these small subsets.

Re: Statefull or not statefull

jdelio — Tue, 12 May 2015 13:53:08 GMT

Nicky,

Thanks for the response, but I am confused why you would need so many IP's in the same range for something like that. It seems unnecessary. I would like to think that you just need to restrict access based upon the IP, and you can do that through a Network Range/subnet.

Re: Statefull or not statefull

NickySorot — Mon, 18 May 2015 12:36:04 GMT

Hi,

what is the delivery timeline of replacement of faulty firewall in case of premium support. our one firewall is down last 2-3 days.

Re: Statefull or not statefull

jdelio — Mon, 18 May 2015 20:59:00 GMT

If you have Premium support, and need to replace a unit, you need to contact the TAC, and report it.

Usually the replacement units are shipped out the next day, and they should arrive 2 days after reported. This sometimes can be quicker, but this is what the official answer is.

Example, Lets say you call Monday, report an issue that needs an RMA, The replacement unit is shipped on Tuesday to arrive on Wednesday Morning Usually before 10:30 AM.

That is unless you have paid for 4 Hour Replacement. Which means 4 hours after the TAC Determines this to be an RMA, you get a replacement unit within 4 hours. But that is ONLY with a 4 hour agreement.

I hope this helps.