About nbilly

Hi Phil, We have a very useful packet capture tool embedded in Panos (Monitor tab -->packet capture in GUI). You can configured several filters and capture traffic in different process stage. (receive, transmit, drop and firewall) To get security rule matching for a given traffic, you can also use the  #test security-policy-match command from CLI. Best Regards -Nicolas ... View more

Hi jeff, For NAT rules, zone matching is based on ingress interface and egress interface after PBF policy or route table lookup. Zone matching for Security rules is a post nat process; so a second lookup will occur after applying destination NAT rule (if there was a Nat policy match). on the other side, for ip matching, in security policy, you always have to keep pre-NAT IP address. When using Static SNAT bi-directional, an implied DNAT rule will be derived from your SNAT one (szone [any],sip [any] - dzone [same],dip [snated ip]). You can see it with # show running nat-policy. In you case, I think something is wrong with routing (maybe a wrong mask), your source IP from DMZ zone seems to be routed back in trust zone... furthermore, don't forget to keep your pre-NAT IP address in your security policy to allow the traffic.. Hope this will help you. Regards -Nicolas ... View more

Hi Andrej, Nothing special is sent when an interface comes up. Gartuitous Arp will be sent over every interfaces (including subint) but only in HA mode and only during a commit or a failover. Best Regards -Nicolas ... View more

Hello Jeff, Allowing ipsec application in your security policy will allow your PAN device to act as vpn passthrough. ipsec application is containing sub-app: ike,ipsec-ah,ipsec-esp,ipsec-esp-udp(NAT-T) implicitly allowed. To allow only icmp-ping, use ping application in your policy. Hope this will help. Regards -Nicolas ... View more