let me correct my below comment   Source IP also any    Source Zone :- Internet Source IP address:-  any Destination Zone :- Lan Destination IP address:- Any Custom URL Categary :- *.xyz.com Port :389 and 8759 Action : Allow ... View more

HI Couvertjy,   Now I allow policy as below, Source Zone :- Internet Source IP address:-  x.x.x.x Destination Zone :- Lan Destination IP address:- Any Custom URL Categary :- *.xyz.com Port :389 and 8759 Action : Allow   It is working, but my question is still there as *.xyz.com is hosted on internet so how can firewall allowing  xyz.com fqdn to access ports on Lan zone through Custom URL category?. So here URL category is acting as source IP . So is it possible that custom url category can act as source or destination IP.   Thanks Dhananjay Bhakte ... View more

HI Alexzandar,   Traffic is not URL traffic and its application is not applicable.  For known fqdn e.g abc.xyz.com it is possible to write rule however fqdn is not fixed, customer says fqdn will change every time but domain (xyz.com) would be fixed, So my query is Can I allow wildcast *.xyz.com instead of single fqdn in security policy using custom url category for custom ports.?   Thanks Dhananjay Bhakte     ... View more

HI Rene,   I have requirement from customer to open port 389 and 4172 for eg *.xyz domain. So I created custom category *.xyz.com and have to create rule by calling this category into rule and will allow only 389 and 4172 ports. As far my understanding url category work only for ssl and web-browsing traffic, so just wanted to know if I keep url category in rule for port port 389 and 4172 will that rule work?   Thanks Dhananjay ... View more

Thank You All for your help!   After enabling NAT traversal on PA firewall, Issue got resolved. Now I am able to ping IBM VPC machines from on-prem machine   Thanks  Dhananjay Bhakte ... View more

Hi MP,   I do not need to configure NAT because  I have IBM local subnet available for routing.   I have checked so far on Palo alto  =>>   1) Tunnel is UP 2)Traffic egress from proper tunnel interface 3)Bytes are sent but not received. 4)Proxy ID is configured since IBM cloud is policy based. 5)Security policies are in placed and traffic passing from correct policy but no return traffic.   I suspect issue from IBM cloud side. I did following on IBM side   1) Created VPC 2) Created VPN gateway 3) Allowed all traffic in security group and ACL   however I am non getting option for adding route. As you mentioned you, configured ipsec tunnel on IBM cloud , can you provide KB article link to configure ipsec tunnel.    Thanks Dhananjay Bhakte ... View more

HI Alexander,   Thank you for replying!   I agree that there is no need of created two policies for one side initiator but In my case both side are initiator. Hence I created two policies.   I checked both phases are UP and can see encrypted traffic in tunnel only from palo side there is no return traffic from IBM end.   As I mentioned on my first comment, I suspect issue from IBM end I will check it again.   @MP18    Could you please help how to setup routing and natting on IBM vpn , In IBM VPN its not letting me to add custom route towards vpn gateway.   Thanks Dhananjay Bhakte  ... View more

HI Steve,   Thanks for replying!   I am initiating traffic from Palo alto side and I can see it is taking Proper tunnel route. I have created two security policy from trust to vpn and vpn to trust as I always create only 2 policies for IPsec tunnel. I am not sure outside to outside policy is need because tunnel is UP only problem is with accessing/pinging IBM from on premises network.   I also pinged from IBM cloud system however I am not getting logs on Palo alto firewall.    Thanks  Dhananjay Bhakte ... View more