logging on intra and interzone

cancel
Showing results for 
Search instead for 
Did you mean: 
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

logging on intra and interzone

L2 Linker

Hello,

I just turned on logging on my intra and inter zone security rules and noticed that in the security logs a few external ip addresses from zone untrust to zone untrust, with the source of a public ip being allowed, session end reason time out.

How can something be allowed from zone untrust to untrust, that doesnt make sense to me?

the same public ip is also logging from zone untrust to zone trust and policy is denied.

1 ACCEPTED SOLUTION

Accepted Solutions

Hi @roma ,

 

I just want to add to @PavelK great explanation:

- Palo FW will make route lookup to determine the destination zone, when packet without a session hit the firewall. Which means that firewall will check its routing table for the destination address.

- If the destination address is IP assigned on the FW interface, the route look up will return the zone associated with that interface. So and since the traffic is comming from internet from and to will be the same zone - untrust.

- If the destination address is IP that is used in NAT policy, the route lookup will be aware of this and will return the zone associated with the route used to reach the translated/internal address. In this case the source is comming from internet and destination (after NAT trannslation) is reachable through through the internal zone, you will see from untrust to trust zone.

- If the destination address is neither assigned on the FW, nor it is used for NAT, the route lookup will again return untrust zone - this is because in your routing table there will be the directly connected network to internet (or if you have purchased additional public range from your ISP, that will be routed to you, but if not used in NAT route lookup will use the default route)

 

Now having in mind how the destination and source zone are determined, you need to look at the default action for intra and inter-zone rules.

View solution in original post

3 REPLIES 3

Cyber Elite
Cyber Elite

Thank you for post @roma

 

this is expected, the security rule: intrazone-default has default action allow while interzone-default has default action deny, so the log you are seeing are corresponding with security rule action.

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

Hi @roma ,

 

I just want to add to @PavelK great explanation:

- Palo FW will make route lookup to determine the destination zone, when packet without a session hit the firewall. Which means that firewall will check its routing table for the destination address.

- If the destination address is IP assigned on the FW interface, the route look up will return the zone associated with that interface. So and since the traffic is comming from internet from and to will be the same zone - untrust.

- If the destination address is IP that is used in NAT policy, the route lookup will be aware of this and will return the zone associated with the route used to reach the translated/internal address. In this case the source is comming from internet and destination (after NAT trannslation) is reachable through through the internal zone, you will see from untrust to trust zone.

- If the destination address is neither assigned on the FW, nor it is used for NAT, the route lookup will again return untrust zone - this is because in your routing table there will be the directly connected network to internet (or if you have purchased additional public range from your ISP, that will be routed to you, but if not used in NAT route lookup will use the default route)

 

Now having in mind how the destination and source zone are determined, you need to look at the default action for intra and inter-zone rules.

L2 Linker

Thank you Astardzhiev, very nice.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!