If the layer 3 traffic is occurring on the Juniper or Cisco switches, you would need to implement the restrictions at that point of the traffic path. As Hulk notes, if the traffic reaches the Palo Alto before the destination then a rule here can restrict the access. But it sounds like you have internal layer 3 connections that are permitted without reaching the Palo Alto. both Cisco and Juniper switches perform this function via packet based (not session based) filters. You create the allow filter and apply this to the layer 3 interface on the switch. On the Juniper switches you would use the feature firewall filters applied to the RVI (Routed Vlan interface) on the switch. Juniper Documentation Firewall Filters Configuration Guide - Technical Documentation - Support - Juniper Networks Free Day One book on the feature: http://www.juniper.net/us/en/community/junos/training-certification/day-one/fundamentals-series/configuring-junos-policies/ On the Cisco switches the feature is ACL (access control lists) Cisco Documentation Configuring IP Access Lists - Cisco Systems
... View more
