Crazy policies needed for BGP and VPN

cancel
Showing results for 
Search instead for 
Did you mean: 

Crazy policies needed for BGP and VPN

L1 Bithead

Hi,

first read this article:

https://live.paloaltonetworks.com/t5/Learning-Arti​cles/Any-Any-Deny-Security-Rule-Changes-Default-B...

 

then

 I have this exactly behavor but I don't have wrote any/any/deny rules!

In my enviroment both intrazone-default and interzone-default are blocked.

It's that the problem ? Bho?

 

To build a VPN with BGP proto inside, all traffic ipsec, and bgp is blocked by intrazone-default.

This policy resolve the problem:

 

"From PA to AWS tunnel VPN" {
        from UNTRUST;
        source 89.186.32.5;
        source-region none;
        to UNTRUST;
        destination [ 52.18.104.192 52.50.11.225 ];
        destination-region none;
        user any;
        category any;
        application/service [ ike/tcp/any/500 ike/udp/any/500
           ipsec-esp/50/any/any ipsec-esp-udp/udp/any/4500
           ipsec-esp-udp/udp/any/4501 ipsec-ah/51/any/any ];
        action allow;
        icmp-unreachable: no
        terminal yes;

 

"From PA to AWS BGP in tunnel VPN" {
        from VPN;
        source [ 169.254.20.78 169.254.21.22 ];
        source-region none;
        to VPN;
        destination [ 169.254.20.77 169.254.21.21 ];
        destination-region none;
        user any;
        category any;
        application/service [ bgp/tcp/any/179 bgp/udp/any/179 ];
        action allow;
        icmp-unreachable: no
        terminal yes;

4 REPLIES 4

L5 Sessionator

If you have modified your intrazone rule and made the action as deny so it means you have to create rule explicitly to allow intrazone traffic.

crazy-policy.JPG

 

 

 

Dear Pankai,

 as you can see from this images, the traffic begin from same physical interface where is the destination....
what kind of intrazone traffic is that?

 

IKE traffic UDP port 500 used for negotiating IPSec tunnels.

Intra-zone means "traffic within the same zone".  Inter-zone means "traffic between different zones".  The default policies for the intrA and intER-zone policies are the last two rules in your security policy:

 

Capture.PNG

 

Old(er) versions of PAN-OS do not show these intra/er-zone rules, but they still exist.  More recent versions show them.  The default is to permit traffic within the same zone (intrazone), and deny traffic between different zones (interzone).  You can override the default action either by editing these rules, or by creating an overriding rule above these default rules.  

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!