topic Re: Source zone - source address in General Topics

Source zone - source address

jdprovine — Thu, 18 May 2017 14:45:39 GMT

If you enter a specific source zone but any for the source address what traffic is really allowed? Does is only allow addresses that are listed in the specified zone or is it truly any IP address?

Re: Source zone - source address

TranceforLife — Thu, 18 May 2017 15:10:32 GMT

Zone => Palo Interface (s) => any ip that Palo sees coming into this interface (s) is allowed.

Re: Source zone - source address

jdprovine — Thu, 18 May 2017 15:49:38 GMT

but you can limited the IP ranges inside the zone configuration can't you

Re: Source zone - source address

TranceforLife — Thu, 18 May 2017 15:57:32 GMT

Sure you can limit address based on single ip address, address groups or subnets etc.

Re: Source zone - source address

jdprovine — Thu, 18 May 2017 18:05:48 GMT

So it would be any of the IP addresses assigned in the specific Zone, not just any of all IP's

Re: Source zone - source address

BPry — Thu, 18 May 2017 18:18:49 GMT

@jdprovine,

A good rule of thumb is to never use ANY as a source address unless you actually need to. For example your Trust zone rules should at the very least be limited to IP addresses that you actually assign from that zone.

Also to be clear, if you use ANY then it allows exactly that, you don't need to assign the IP to that zone for it to be allowed.

Re: Source zone - source address

TranceforLife — Thu, 18 May 2017 19:37:32 GMT

as @BPry has mentioned already any means from anywhere, even from the different subnet. A good example is DNAT. You allow any ip from the lnternet to access your internal server. So in your policy, you configuring ANY as a source ip going to untrust zone. Let's say your untrust interface has 92.16.0.1/24 ip address assigned. ANY means any ip addresses, even outside of this subnet are allowed (e.g 84.8.9.1, 74.8.6.1 etc).

Re: Source zone - source address

jdprovine — Fri, 19 May 2017 19:26:52 GMT

these rules were migrated over from and ASA 5510 before I even got here, and I agree the fewer the any's the better. But if you have a range of IP's addressed to the Source Zone, doesn't the any under IP addresses only mean any of the IP's configured on the Zone?

Re: Source zone - source address

TranceforLife — Fri, 19 May 2017 19:55:59 GMT

No, a zone is a logical area and you will have at least one interface in that zone. So you have one interface in the zone. That interface connected to the router, then we do have another router and so on. Routers always interconnect networks (different networks/subnets). With configuration "any" firewall will allow any source ip coming into that interface, as l said earlier even from the outside of the interface subnet. If you have multiple interfaces withing the same zone, any ip outside the zone. So ip address not necessarily should be directly connected to the PA, but logically they will be in the same zone.

Re: Source zone - source address

Remo — Fri, 19 May 2017 19:58:12 GMT

It also depends on your routing table.

So let's assume you have interface eth1/1 in zone "INTERNAL". All your internal networks are somewhere in 10.0.0.0/8 and are reachable through an internal router. To keep the routing easy you have one route for the 10.0.0.0/8 network towards your router.

Now if there somehow traffic from 192.168.100.100 arrives at your firewall on eth1/1 (Zone INTERNAL), then this traffic is not allowed even you have allowed "any" in the source address column and INTERNAL as source zone in your security policy. This packet (and everything else which does not come from 10.0.0.0/8) will get dropped as ip spoof attack.

Re: Source zone - source address

Raido_Rattameister — Sun, 21 May 2017 03:07:52 GMT

To be exact IP spoof attack is not detected by default but only if zone protection is applied to the zone and ip spoof checkbox checked (it is best practice to have it configured).

Re: Source zone - source address

Remo — Sun, 21 May 2017 07:35:13 GMT

@Raido_Rattameister : of course, you're absolutely right. Sometimes the "best practices" are more/(too much) "must" settings to me 😛