How security policy - intrazone works?

[jeremylo]

Trying to use a Security policy with type intrazone and action is Deny (any application & service).

Target is to block all communication within the same zone (subnet). Such as ping, file share (smb), ftp, etc.

The layer3 interface and the computers were connected to a unmanaged switch.

But the outcome is only the gateway (layer3 interface) cannot be contact. All the computers can still comunicate with each other.

[Mick_Ball]

Your devices are on the same broadcast domain so they do not need to pass through the PA interface to communicate with each other.

search this site for “intrazone”. 

[Mick_Ball]

Nice pop from Mr Reaper...

https://live.paloaltonetworks.com/t5/General-Topics/Intrazone-Rules/m-p/147789#M49440

[RobinClayton]

Hosts on the same subnet never see the firewall.

Intrazone seperates different subnets from each other, and requires that the firewall is the Gateway for these subnets.

[JoeAndreini]

You could segregate traffic within the same subnet using L2 or vwire interfaces and inspect the traffic using intra-zone rules.

[jeremylo]

---

@JoeAndreini wrote:

You could segregate traffic within the same subnet using L2 or vwire interfaces and inspect the traffic using intra-zone rules.

---

Hello JoeAndreini,

This seems impractical. I'll have huge workload to assign each computer to has its own L2 interface.