I'm new in Paloalto firewalls, i'm doing a migration from Fortigate to PA220. i configured all interfaces, router... but I'm struggling with Policies
attached the basic policy i created to allow my LAN users to access internet:
After testing the PA:
PS: we have an internal DNS, Activedirectory, but in the PA220 i configured the DNS using 188.8.131.52 "Attached config"
PS: NAT configured "Attached config"
can you please advice if i'm missing something.
Thank you in advance
the service route is only used by the management interface of the firewall, it is used when the physical mgmt interface is located in an oob network that has no internet access
if you have any any open in all directions and you can only reach IP addresses, there must be something wrong with how DNS is resolved
can you check which DNS server is on your clients
what if you replace that with 184.108.40.206
in case your clients do dns lookups on your AD, can you see those connections in the firewall sessions and is there packets sent AND received ?
set up wireshark on client and AD to see if both see all packets
then, do the same with AD and it's upstream DNS: do you see dns queries leave and come back? what if you set the upstream ('Forwarders') to 220.127.116.11
the 18.104.22.168 you show in the screenshot is only used by the management interface of the firewall itself. you do have a security policy that would allow dns coming from your network to go out to the internet
did you add dns servers to your dhcp options so clients are issued with dns servers (your AD)? (and if the AD is being assigned, did you verify the AD has access to the internet?)
Thank you @reaper for your reply
I didn't configure a policy that would allow dns coming from DMZ" AD+DNS" to ==> Internet, i will configure it.
for your second point: the active directory is acting also as an DHCP so i configured a DHCP relay in the PaloAlto.
i have to verify if the AD have access to internet also.
the policies to go out to internet are correct or maybe i have to change something ?
Ah ha @wzahri ! With 3 interfaces things get a little more complex 🙂
You'll want the dhcp relay on the LAN interface pointing to the AD
From lan to dmz "all AD services (dns, smb, netbios, ....)" Allow
From dmz to untrust dns/ntp/ms-updates allow
From lan to untrust "web apps" allow
From lan+dmz to untrust block log
From lan+dmz interzone block log
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!