Application Override Policy Match Criteria, does it match on Pre or Post-NAT Zone/IP?

[Smi12]

Hello

I'm currently configuring a PA-2050 running PAN 5.0.9

Can anyone confirm if the Application Override Policy match criteria should be configured to match on the Pre-NAT or Post-NAT zones and IP addresses.  I'm assuming it will match in the same way as a security policy does, and use the Post-NAT Zone, while the IP address match is based upon the Pre-NAT original packet destination?

I've just read the PAN 5.0 Admin Guide and it makes no mention of the Application override match criteria with regard to NAT and neither does . 

Any help would be appreciated, thanks in advance. 

[dpalani · Accepted solution]

Hi,

The application override must behave like a security policy and it is parsed after the nat rule is parsed. Therefore your rule must have zones and ips similar to the security rule.

Deepak

[hyadavalli]

Hello Smi,

Please take a look at below document explaining about packet flow in panos.

https://live.paloaltonetworks.com/docs/DOC-1628

Regards,

Hari Yadavalli