Problem with Security Zones.

[omarali53]

Dear Members, 

I need some help regarding the Paloalto firewall. We are managing the firewalls using the Panorama. I am new in the environment. I have been told that the source subnet resides in the inside zone hence I added the source group in the inside zone configured it correctly. 

In the firewalls logs I can see that the traffic has started hitting the rule (which looks good). But for some reasons the user is reporting that he can not access the service and says that he is getting the error that the port is not reachable but we can see that the traffic on port 443 is allowed. In he below we can see that the traffic is allowed and the source zone is inside (interface ae3.99). the picture is from panorama gui. 

Just to make sure I logged into the CLI of the firewall and checked the routing table and zone of the source subnet. Here I am amazed to see that the CLI is showing a different source zone for the same IP address. here it is showing that the source interface is ae3.199 which is a different zone then inside. 

The routing table also states that the traffic from the subnet 10.151.0.0/16 belongs to the different zone (other than Inside). 

Now I am curious that the Panorama GUI is showing that the source IP 10.151.103.124 belongs to the Inside zone. But the CLI in firewall and routing table states that the same IP belongs to the different zone. Someone please help me how to rectify and resolve this issue? what could be the cause of this problem? 

[omarali53]

someone please help me. 😞

[rmfalconer]

Looks like something is incorrect with your routing. The only route to 10.151.103.124 is through an interface in another zone, not through an interface on the inside zone.

Where is the route for the more specific network 10.151.103.124? Do you have some kind of asymmetric routing happening?