topic Re: PBF Rule not being hit in General Topics

PBF Rule not being hit

WhiteKnight — Tue, 30 Jul 2019 12:27:58 GMT

I am experiencing an issue with one of our PAN devices, which is a PA-500 running OS 7.0.19. I have created a new PBF rule to forward traffic from a certain subnet to the inside interface of our edge router. I have several other rules pointing other subnets at the same interface which work fine. The PBF rule did not seem to work (yes it is commited). So, I ran the test from the CLI as below.

Zone/Interface: Zone2

Source Address: 10.80.80.0/24 (not real IP)

Destination Address: Any

Application: Any

Service: Any

Action: Forward

Egress Interface: Ethernet 1/2

Next hop: 12.12.12.1 (not real IP)

From CLI - test pbf-policy-match protocol 6 from Zone2 source 10.80.80.15 destination 8.8.8.8 destination-port 80

The results: "No rule matched"

Any idea what can cause this?

Re: PBF Rule not being hit

BPry — Tue, 30 Jul 2019 16:31:30 GMT

@WhiteKnight,

Just for fun, can you try setting the source as a single IP and then running your tests again?

Re: PBF Rule not being hit

WhiteKnight — Tue, 30 Jul 2019 17:31:51 GMT

I was actually just trying that. I have a test box sitting on that subnet now. The rule is now set for the entire subnet as well as the single IP address. I didn't try the rule with the single IP and remove the subnet. I'll try that now.

Edit: I edited to rule to have the source as a single IP. It still results in "No rule matched"

Re: PBF Rule not being hit

BPry — Tue, 30 Jul 2019 17:35:41 GMT

@WhiteKnight,

And just to verify, have you looked for any validation errors with you having too many PBF entries? I know that our old 4000s back in the day could handle more than a few, so I doubt you are reaching the limit, but it might be worth checking.

Re: PBF Rule not being hit

WhiteKnight — Tue, 30 Jul 2019 17:38:38 GMT

I always validate before commiting. When I do validate, there are no errors.

Re: PBF Rule not being hit

BPry — Tue, 30 Jul 2019 17:42:59 GMT

@WhiteKnight,

Hmm, that seems really odd. The only other reason I would suspect this to not work is if you were trying to utilize PBF for a globalprotect client. Outside of that you might want to open a ticket with TAC.

Re: PBF Rule not being hit

WhiteKnight — Tue, 30 Jul 2019 17:46:19 GMT

Ok, thanks for the feedback. We do have current support but I figured it was worth asking here. Incase I'm completely overlooking something.

Thank you,

Matt