topic Re: Crazy policies needed for BGP and VPN in General Topics

Crazy policies needed for BGP and VPN

Passepartout — Wed, 06 Apr 2016 10:03:17 GMT

Hi,

first read this article:

https://live.paloaltonetworks.com/t5/Learning-Articles/Any-Any-Deny-Security-Rule-Changes-Default-Be...

then

I have this exactly behavor but I don't have wrote any/any/deny rules!

In my enviroment both intrazone-default and interzone-default are blocked.

It's that the problem ? Bho?

To build a VPN with BGP proto inside, all traffic ipsec, and bgp is blocked by intrazone-default.

This policy resolve the problem:

"From PA to AWS tunnel VPN" {
        from UNTRUST;
        source 89.186.32.5;
        source-region none;
        to UNTRUST;
        destination [ 52.18.104.192 52.50.11.225 ];
        destination-region none;
        user any;
        category any;
        application/service [ ike/tcp/any/500 ike/udp/any/500
           ipsec-esp/50/any/any ipsec-esp-udp/udp/any/4500
           ipsec-esp-udp/udp/any/4501 ipsec-ah/51/any/any ];
        action allow;
        icmp-unreachable: no
        terminal yes;

"From PA to AWS BGP in tunnel VPN" {
        from VPN;
        source [ 169.254.20.78 169.254.21.22 ];
        source-region none;
        to VPN;
        destination [ 169.254.20.77 169.254.21.21 ];
        destination-region none;
        user any;
        category any;
        application/service [ bgp/tcp/any/179 bgp/udp/any/179 ];
        action allow;
        icmp-unreachable: no
        terminal yes;

Re: Crazy policies needed for BGP and VPN

pankaku — Wed, 06 Apr 2016 12:02:25 GMT

If you have modified your intrazone rule and made the action as deny so it means you have to create rule explicitly to allow intrazone traffic.

Re: Crazy policies needed for BGP and VPN

Passepartout — Wed, 06 Apr 2016 12:14:43 GMT

Dear Pankai,

as you can see from this images, the traffic begin from same physical interface where is the destination....
what kind of intrazone traffic is that?

Re: Crazy policies needed for BGP and VPN

pankaku — Wed, 06 Apr 2016 13:19:06 GMT

IKE traffic UDP port 500 used for negotiating IPSec tunnels.

Re: Crazy policies needed for BGP and VPN

jvalentine — Wed, 06 Apr 2016 14:59:17 GMT

Intra-zone means "traffic within the same zone". Inter-zone means "traffic between different zones". The default policies for the intrA and intER-zone policies are the last two rules in your security policy:

Old(er) versions of PAN-OS do not show these intra/er-zone rules, but they still exist. More recent versions show them. The default is to permit traffic within the same zone (intrazone), and deny traffic between different zones (interzone). You can override the default action either by editing these rules, or by creating an overriding rule above these default rules.