topic Allowing any traffic that comes from a specific palo alto device in General Topics

Allowing any traffic that comes from a specific palo alto device

orkun.yalcin — Thu, 20 Aug 2020 20:16:46 GMT

Hello

Assume 2 local firewalls in a set of firewalls, all managed by same Panorama. One is protecting ATM firewall and the other is DC Server firewall.

ATM 's get their IP 's from branches so they are very random, and routing is basically like 10.0.0.0/8 ge 27 le 30 and 10.0.0.0/8 ge 29 le 30. So we dont know IP, Range, subnet for a firewall rule, they are very random. If we try to make a list it would not be maintainable.

We accept the risk while writing a firewall policy on atm firewall, where as we define source or destination "any" for specific addresses / ports.

The problem occurs when we need to give access from DC firewall. Because we cant write destination of ATM 's, we have to write a rule which basically is like from:serverip to:any port:x, which applies to "all" traffic going outside of DC server firewall from this ip, regardless of being sent to atm firewall.

I am looking for a way to manage this, like allow traffic from server ip to any destination, only if the destination is on atm firewall. Can we manage this via zones / tags or else. Firewalls are vwire.

Thanks in advance

Regards

Re: Allowing any traffic that comes from a specific palo alto device

SutareMayur — Fri, 21 Aug 2020 10:30:41 GMT

@orkun.yalcin How your DC firewall is connected to ATM firewall ? If it is over dedicated interface then you can have dedicated zone on the interface and write zone based policy with any destination addresses to allow ATM destinations.

Re: Allowing any traffic that comes from a specific palo alto device

orkun.yalcin — Fri, 28 Aug 2020 08:58:17 GMT

Nope unfortunately there is no dedicated interface for this.

Re: Allowing any traffic that comes from a specific palo alto device

SutareMayur — Fri, 28 Aug 2020 13:59:53 GMT

@orkun.yalcin,

Then how are they connected?