topic Re: Rule bypassed when specific ip entered for destination (PanOS 8.1) in General Topics

Rule bypassed when specific ip entered for destination (PanOS 8.1)

rwolsen — Wed, 16 Sep 2020 14:38:26 GMT

I have a rule that has been failing to allow connections to the internal system. To test i've set up the rules below. (IP's obfuscated)
When I run
> test security-policy-match source 1.1.1.206 destination 2.2.2.226 protocol 22
the response is

"External-TEST-OPEN; index: 2" {

I am currently able to connect from external to internal with the External-TEST-OPEN, but why is it that when i put in the specific internal system ip that i can't connect? What am i missing?

Rick.
-------------------------------

TEST-Dest-IP {
from untrust;
source 1.1.1.206;
to "Zone Internal";
destination 2.2.2.226;
service any;
application ssh;
action allow;
category any;
rule-type universal;
}
External-TEST-OPEN {
to "Zone Internal";
from untrust;
source [ 1.1.1.206 1.1.1.201];
destination any;
source-user any;
category any;
application ssh;
service any;
hip-profiles any;
action allow;
rule-type universal;
log-setting Log_Forwarding-Traffic;

Re: Rule bypassed when specific ip entered for destination (PanOS 8.1)

Braden_Tolman — Thu, 17 Sep 2020 04:56:08 GMT

Is the Palo performing NAT translations for the inbound traffic? If so, is your security policy defining the pre-NAT IP and post-NAT zone?

Re: Rule bypassed when specific ip entered for destination (PanOS 8.1)

rwolsen — Thu, 17 Sep 2020 17:49:26 GMT

No, we are not NAT'ing.

Re: Rule bypassed when specific ip entered for destination (PanOS 8.1)

Rene_Boehme — Sat, 19 Sep 2020 20:22:50 GMT

Hi,

can you please set up the command this way:

test security-policy-match from untrust source 1.1.1.206 to Zone Internal destination 2.2.2.226 destination-port 22 protocol 6

- if i remember correctly zones names with blanks in it wont work on CLI

- with protocol Palo does not mean the application. Check this:

https://en.wikipedia.org/wiki/List_of_IP_protocol_numbers

For the security policies it looks like they have been manipulated. Could you please copy the exact output, for related policies, of this command?

> show running security-policy

Re: Rule bypassed when specific ip entered for destination (PanOS 8.1)

BPry — Sun, 20 Sep 2020 04:14:17 GMT

@Rene_Boehme,

The CLI can handle spaces fine, you just have to group them properly so its not escaped. So in the example that you have you would actually need to have it like so.

test security-policy-match from untrust source 1.1.1.206 to "Zone Internal" destination 2.2.2.226 destination-port 22 protocol 6