Actually if you take a step back and look at the configuration, Ethernet 1/1 and Ethernet 1/3 are both in VLAN300, and are part of different zones. CustA-Servers (zone) is permitted to talk to CustA-vDS (zone) and vice-versa through this rule.
This rule can not control traffic from CustA-Servers to CustA-Servers, because that traffic does not traverse the firewall. The only way you'll get traffic to traverse the firewall is to insert it _between_ the two servers. This can be done with v-Wires, Layer2 (recommended in a virtualized datacenter) or Layer3.
Think of this like a perimeter firewall. You don't just connect one interface to your LAN switch and call it good. You connect one interface to the Internet, and another Interface to your internal network. The firewall will inspect traffic passing from LAN to Internet and vice-versa. But, just because the firewall is plugged into your LAN doesn't mean that all of your LAN-to-LAN traffic goes through the firewall... Same thing with the VM Series. You need to plumb the traffic appropriate so that it passes through the firewall.
In the PDF you referenced, there's a great graphic that illustrates this point:
Server A1 and Server A2 can talk to each other directly because they are on the same VDS on the same host. Their traffic does not pass through the firewall. However, traffic from A1 to B1 <must> go through the firewall, and that is where you can enforce policy. Also look at Server B1 and B2, they can talk to each other without traversing the firewall. However, for B1 to communicate with B3, that traffic must pass through 2 different firewalls - one on each ESXi host. In this example, there are 2 different places where you could apply policy.
Hope that helps.
Hi,
yes my configuration is just like you describe, but if you review official doc from Palo Alto Networks "VM-Series_Deploymnt-RevA.pdf", they have example scenario, where have one L2 interface which permit/deny traffic within same security zone.
after while, they filter permited traffic within same sec zone
You can see that example interface eth1/3 belongs to vlan 300 (supposed one port group), and rule "allow some stuff CustA" with statement between same zones, allow ping.
Actually if you take a step back and look at the configuration, Ethernet 1/1 and Ethernet 1/3 are both in VLAN300, and are part of different zones. CustA-Servers (zone) is permitted to talk to CustA-vDS (zone) and vice-versa through this rule.
This rule can not control traffic from CustA-Servers to CustA-Servers, because that traffic does not traverse the firewall. The only way you'll get traffic to traverse the firewall is to insert it _between_ the two servers. This can be done with v-Wires, Layer2 (recommended in a virtualized datacenter) or Layer3.
Think of this like a perimeter firewall. You don't just connect one interface to your LAN switch and call it good. You connect one interface to the Internet, and another Interface to your internal network. The firewall will inspect traffic passing from LAN to Internet and vice-versa. But, just because the firewall is plugged into your LAN doesn't mean that all of your LAN-to-LAN traffic goes through the firewall... Same thing with the VM Series. You need to plumb the traffic appropriate so that it passes through the firewall.
In the PDF you referenced, there's a great graphic that illustrates this point:
Server A1 and Server A2 can talk to each other directly because they are on the same VDS on the same host. Their traffic does not pass through the firewall. However, traffic from A1 to B1 <must> go through the firewall, and that is where you can enforce policy. Also look at Server B1 and B2, they can talk to each other without traversing the firewall. However, for B1 to communicate with B3, that traffic must pass through 2 different firewalls - one on each ESXi host. In this example, there are 2 different places where you could apply policy.
Hope that helps.
