Destination Zone

[didier.bonato]

Hello

I found in documentation : "Assign destination zone based on Interface packet would egress from"

What is behind this "would" ? How is choose the destination zone , based on FW topology or routing table or ?

I have set a route (next hop Tunnel interface) to a subnet and a NAT rule.

I have a traffic from 2 differents source zone but same destination.

In log, destination zone is not the same for each traffic;

My rules are working but I can't explain why.

So how is based the choice for the destination zone ?

Thanks in advance

[OtakarKlier]

Hello,

As for the logs, enable logging at session end on all polcies and then check the traffic logs to see what they say. As for egress zone, its where the traffic is going or where it will end up. Each interface must be assigned a zone, where the packets leaves the firewall interface, that would be the egress zone based on the interface.

Regards,

[didier.bonato]

Hello

Thanks for your reply.
My question is not : how i can check the destination zone but how PAN OS set it ?

After checking routing table or depending on the topology of firewall or something else ?

Regards

[Raido_Rattameister]

Destination zone is decided based on routes in virtual router so yes routing table.

If you have Policy Based Forwarding rules that overlap with virtual router then PBF route will take precedence over virtual router.