topic untrusted webbrowsing in General Topics https://live.paloaltonetworks.com/t5/general-topics/untrusted-webbrowsing/m-p/9578#M7014 <HTML><HEAD></HEAD><BODY><P><BR />Hi there</P><P>Ive set up the firewall with a trusted lan for staff and untrusted lan for visitors.</P><P>I don want the visitor lan to access the staff lan, however the first rule created was to allow webbrowsing, i cloned it and added the visitor source addess to the rule, however anything on the visitor side cannot access any web site.</P><P>Ive allowed dns from a staff lan dns server and i have check to allows resolution on, whe i look at the logs it shows the sender ip, with the correct rule classification but shows traffic as incomplete.</P><P>The staff rule works ok, is there anything obvious im missing?</P><P></P><P>Thanks.</P></BODY></HTML> Mon, 08 Jul 2013 11:31:25 GMT Buccaneer 2013-07-08T11:31:25Z untrusted webbrowsing https://live.paloaltonetworks.com/t5/general-topics/untrusted-webbrowsing/m-p/9578#M7014 <HTML><HEAD></HEAD><BODY><P><BR />Hi there</P><P>Ive set up the firewall with a trusted lan for staff and untrusted lan for visitors.</P><P>I don want the visitor lan to access the staff lan, however the first rule created was to allow webbrowsing, i cloned it and added the visitor source addess to the rule, however anything on the visitor side cannot access any web site.</P><P>Ive allowed dns from a staff lan dns server and i have check to allows resolution on, whe i look at the logs it shows the sender ip, with the correct rule classification but shows traffic as incomplete.</P><P>The staff rule works ok, is there anything obvious im missing?</P><P></P><P>Thanks.</P></BODY></HTML> Mon, 08 Jul 2013 11:31:25 GMT https://live.paloaltonetworks.com/t5/general-topics/untrusted-webbrowsing/m-p/9578#M7014 Buccaneer 2013-07-08T11:31:25Z Re: untrusted webbrowsing https://live.paloaltonetworks.com/t5/general-topics/untrusted-webbrowsing/m-p/9579#M7015 <HTML><HEAD></HEAD><BODY><P>You are probably missing a Source NAT translation from visitor&nbsp; lan to the untrust zone, NATing it to the IP address of the untrust interface.</P><P></P><P>BR,</P><P>Karthik RP</P></BODY></HTML> Mon, 08 Jul 2013 12:30:12 GMT https://live.paloaltonetworks.com/t5/general-topics/untrusted-webbrowsing/m-p/9579#M7015 kprakash 2013-07-08T12:30:12Z