Here is a quote from the Help Guide on PAN-OS 6.1 in the PBF section that clearly specifies that Regions is an option for the Destination: Destination/Application/Service Tab Use the Destination/Application/Service tab to define the destination settings that will applied to traffic that matches the forwarding rule. Field Description Destination Address Click Add to add destination addresses, address groups, or regions (default is any). Select from the drop-down list, or click the Address,Address Group, :smileyshocked:or Regions:smileyshocked: link at the bottom of the drop-down list, and specify the settings. Full Section::smileyshocked: Policy-Based Forwarding Policies Policies > Policy Based Forwarding Normally, when traffic enters the firewall, the ingress interface virtual router dictates the route that determines the outgoing interface and destination security zone based on destination IP address. With policy-based forwarding (PBF), you can specify other information to determine the outgoing interface, including source zone, source address, source user, destination address, destination application, and destination service. The initial session on a given destination IP address and port that is associated with an application will not match an application-specific rule and will be forwarded according to subsequent PBF rules (that do not specify an application) or the virtual router’s forwarding table. All subsequent sessions on that destination IP address and port for the same application will match an application-specific rule. To ensure forwarding through PBF rules, application-specific rules are not recommended. When necessary, PBF rules can be used to force traffic through an additional virtual system using the Forward-to-VSYS forwarding action. In this case, it is necessary to define an additional PBF rule that will forward the packet from the destination virtual system out through a particular egress interface on the firewall. For configuration guidelines and information on other policy types, refer to “Policies and Security Profiles”. For information on defining policies on Panorama, see “Defining Policies on Panorama”. The following tables describe the policy-based forwarding settings: • “General Tab” • “Source Tab” • “Destination/Application/Service Tab” • “Forwarding Tab” General Tab Use the General tab to configure a name and description for the PBF policy. A tag can also be configured to allow you to sort or filter policies when a large number of policies exist. Field Description Name Enter a name to identify the rule (up to 31 characters). The name is case-sensitive and must be unique. Use only letters, numbers, spaces, hyphens, and underscores. Only the name is required. Description Enter a description for the policy (up to 255 characters). Tag If you need to tag the policy, click Add to specify the tag. A policy tag is a keyword or phrase that allows you to sort or filter policies. This is useful when you have defined many policies and want to view those that are tagged with a particular keyword. For example, you may want to tag certain security policies with Inbound to DMZ, decryption policies with the words Decrypt and No-decrypt, or use the name of a specific data center for policies associated with that location. Source Tab Use the Source tab to define the source zone or source address that defines the incoming source traffic to which the forwarding policy will be applied Field Description Source Zone To choose source zones (default is any), click Add and select from the drop-down list. To define new zones, refer to “Defining Security Zones”. Multiple zones can be used to simplify management. For example, if you have three different internal zones (Marketing, Sales, and Public Relations) that are all directed to the untrusted destination zone, you can create one rule that covers all cases. Note: Only Layer 3 type zones are supported for policy-based forwarding. Source Address Click Add to add source addresses, address groups, or regions (default is any). Select from the drop-down list, or click the Address, Address Group, or Regions link at the bottom of the drop-down list, and specify the settings. Source User Click Add to choose the source users or groups of users subject to the policy. The following source user types are supported: • any—Include any traffic regardless of user data. • pre-logon—Include remote users that are connected to the network using GlobalProtect, but are not logged into their system. When the Pre-logon option is configured on the Portal for GlobalProtect clients, any user who is not currently logged into their machine will be identified with the username pre-logon. You can then create policies for pre-logon users and although the user is not logged in directly, their machines are authenticated on the domain as if they were fully logged in. • known-user—Includes all authenticated users, which means any IP with user data mapped. This option is equivalent to the “domain users” group on a domain. • unknown—Includes all unauthenticated users, which means IP addresses that are not mapped to a user. For example, you could use unknown for guest level access to something because they will have an IP on your network, but will not be authenticated to the domain and will not have IP to user mapping information on the firewall. • Select—Includes selected users as determined by the selection in this window. For example, you may want to add one user, a list of individuals, some groups, or manually add users. Note: If you are using a RADIUS server and not the User-ID Agent, the list of users is not displayed, and you must enter user information manually. Destination/Application/Service Tab Use the Destination/Application/Service tab to define the destination settings that will applied to traffic that matches the forwarding rule. Field Description Destination Address Click Add to add destination addresses, address groups, or regions (default is any). Select from the drop-down list, or click the Address,Address Group, or Regions link at the bottom of the drop-down list, and specify the settings.
... View more
