Zone Assignment

jpvh1234 — Wed, 09 Jan 2013 14:59:38 GMT

In PanOS, how are the zones established for inbound rules? I have a bi-directional NAT created for a device located in a DMZ. I also have a security policy allowing traffic to the NAT address from the untrusted zone (Internet). When traffic comes in, it is marked as source zone => untrusted, destination zone => trusted and denied because there is no policy for untrusted to trusted. Shouldn't the destination zone be my DMZ? See attached file for the log.

Re: Zone Assignment

nbilly — Wed, 09 Jan 2013 16:14:37 GMT

Hi jeff,

For NAT rules, zone matching is based on ingress interface and egress interface after PBF policy or route table lookup.
Zone matching for Security rules is a post nat process; so a second lookup will occur after applying destination NAT rule (if there was a Nat policy match).
on the other side, for ip matching, in security policy, you always have to keep pre-NAT IP address.

When using Static SNAT bi-directional, an implied DNAT rule will be derived from your SNAT one (szone [any],sip [any] - dzone [same],dip [snated ip]).
You can see it with # show running nat-policy.

In you case, I think something is wrong with routing (maybe a wrong mask), your source IP from DMZ zone seems to be routed back in trust zone...
furthermore, don't forget to keep your pre-NAT IP address in your security policy to allow the traffic..

Hope this will help you.

Regards

-Nicolas

topic Re: Zone Assignment in General Topics

Zone Assignment

Re: Zone Assignment