block IP's in same zone

[jdprovine]

Is it possible or practical to block traffic between two server in the same firewall zone by designating the source IP from the server you want to block access to the server to the destination server indicated by IP

[jdprovine]

No the servers would have gateways associated with the vlan that they reside in

[RobinClayton]

So the gateway for each vlan is not the firewall.

What is the gateway device

[jdprovine]

No why would that gateway be on the firewall? The gateway would be a router

[RobinClayton]

So does the router know about both vlans? and do the routing for both vlans?

Rob

[jdprovine]

Yes the routing it set up for the vlan I am talking about.  So what does this have to do with blocking the IP's  on the firewall?

[RobinClayton]

So server "A" "192.168.0.1" sends packet to serve "B" "192.168.1.1"

Router gets packet, forwards to server "B"

How does the firewall ever see the traffic?

Rob

[jdprovine]

That brings us back to my original question can you block traffic between two servers in the same security zone using a plao alot firewall rule and I believe the conclusion is that you can't because it isn't being passed or seen on the firewall

[OtakarKlier]

Hello @jdprovine,

By making the firewall the gateway address you can better acheive the zero trust modle where any traffic going into/outof that vlan can be inspected for threats.

https://www.paloaltonetworks.com/solutions/initiatives/network-segmentation

https://www.paloaltonetworks.com/cyberpedia/what-is-a-zero-trust-architecture

Also depending on the vlan/subnet architecture, you can acheive your original question.

Hope that helps.

[RobinClayton]

Your traffic never goes to the firewall, it has no knowledge of it.

For intrazone blocking to work the firewall must be used as the gateway for the subnet.

This is not a problem with the Palo it's the same for any vendor.

[jdprovine]

@OtakarKlier

So are you suggesting using the PA as the router for all our network traffic?

[RobinClayton]

yes for any subnets you want to segregate.

Rob

[OtakarKlier]

Hello,

In a perfect world I would say yes. However this has a lot of dependancies and takes a lot of planning. In the past the routers/switches were the core of the network. The zero trust method makes the PAN the cetner of hte network. Its a bigger conversation you need to have with all the teams in the Infrastrucutre dept, i.e. servers, networking, security, etc.

The biggest probelm with this model is layer 2, hence my recomendation of one zone subnetted out to like a /29 and only 1 server/node per subnet. This can be acheived many ways, but what i suggested is the easiest if you dont have a SDN solution.

Regards,

[jdprovine]

@OtakarKlier

Very interesting I will look over the articles you sent me, but would this allow me to block traffic between two servers in the same security zone?

[RobinClayton]

You can's block servers on the same subnet.

[RobinClayton]

But if the zone has multiple subnets then yes if they are routed by the firewall.