topic Re: Connection Issues between servers in General Topics

Connection Issues between servers

JonHill — Fri, 05 Jul 2019 13:47:29 GMT

I'm very new to PAN firewalls and are still learning as I go along, they've only been in a month or so and the only rule is currently set any any from the trust to untrust zones and vice versa.

We've got a couple of issues around some connections that traverse our 5250's (LAN to WAN and vice versa) but from the 5250's perspective its not seeing any traffic in the logs for the addresses in question, no deny drops allows nothing.

When we've done a packet capture from the servers on either end of the connection it shows the traffic leaving but its never seen on the 5250's. We've checked the routing and everything else in between but we've found nothing wrong.

Zone protection profile has been disabled.

Is there anything else that I can check to see if for one reason or another the 5250's are doing something they shouldn't to the traffic?

Any help would be much appreciated?

Thanks

Jon

Re: Connection Issues between servers

BPry — Fri, 05 Jul 2019 14:38:04 GMT

@JonHill,

Ensure that you've actually enabled logging on the interzone-default policy and ensure you've checked interface counters for any dropped packets. Did you do a PCAP on the actual firewall yet or not? That would be my next stop if everything else checks out so you can see that it's at least hitting the firewall and being processed correctly.

Re: Connection Issues between servers

OtakarKlier — Fri, 05 Jul 2019 17:09:59 GMT

Hello,

Also check the logs to see where and why you are getting dropped. If you have Application set for any and Service set to Application-default, then the PAN may identify some apps over non-standard ports and block the traffic.

However as you mentioned your config, I would highly recommend that you not use any/any from untrust to trust, unless you have another firewall in between. Also there is free training online to help you along.

https://paloaltonetworks.csod.com

As always you can post in here and we'll help out the best we can :).

Cheers!