I have an issue where, Panorama had some security policy rules that had the below configuration on them:
The Panorama was then upgraded from 9.0.11 to 9.1.0 and during the upgrade process the Panorama through an error saying that you are unable to have this type of configuration on a security policy rule. The rule's were tidied up and the upgrade completed.
My question's are:
1. Obviously that type of config on a rule is redundant, but are you able to have that type of configuration on a security policy rule in Panorama or an a NGFW? When testing having 'any' or 'application default' and a service selected on a security policy, PAN doesn't allow you to do it. The firewall automatically switches to one or the other before you perform the commit.
2. Is this something PAN may have changed between OS releases?
3. Has the upgrade just exposed this incorrect configuration? If so, why was able to be commited in the first place?
Thanks in advance for any advise here.
I'm not exactly sure what you're asking to be honest. Are you trying to combine 'any' and 'application-default' in the same rulebase entry? You can't specify 'any' and then list individual services, likewise you can't specify 'application-default' and then list additional services, and lastly you can't specify 'any' and 'application-default'.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!