About DhananjayBhakte

Thanks Cyber Elite I Got it now......... 🙂   ... View more

HI,   In addition to above query, I got new requirement from customer as below   Source Zone : trust Source user :- abc Destination Zone :- Untrust(internet) Destination :-  *.ncra.tifr.res.in Port : 22 Application: SSH   So to achieve above requirement  , I have created custom url category as *.ncra.tifr.res.in and created rule as below.   Policy :--   Source Zone : trust Source user :- abc Destination Zone :- Untrust(internet) Destination :-  any Port : 22 url category :- *. ncra.tifr.res.in Application: SSH Profile :- None Action :- Allow   However it is not working. Note :- Customer  dont have fqdn he provided *.ncra.tifr.res.in   So I wanted to know that  *.ncra.tifr.res.in custom category not work for application other than web browsing and ssl?     Thanks Dhananjay ... View more

I Have similar problem however in my case on firewall when I create fqdn object it resolve to  IP and when I use same object in rule that rule doesnt work, then I need to add IPs manualy based on deny logs in same rule.   I observe one strange thing when I resolved fqdn address object it resolved to some different IPs and when I nslookup fqdn in cmd it resolved to some  completely different subnet  IPs and same IPs when I allowed in rule then rule works. I guess  firewall is not resolving to correct IPs .     ... View more

let me correct my below comment   Source IP also any    Source Zone :- Internet Source IP address:-  any Destination Zone :- Lan Destination IP address:- Any Custom URL Categary :- *.xyz.com Port :389 and 8759 Action : Allow ... View more

HI Couvertjy,   Now I allow policy as below, Source Zone :- Internet Source IP address:-  x.x.x.x Destination Zone :- Lan Destination IP address:- Any Custom URL Categary :- *.xyz.com Port :389 and 8759 Action : Allow   It is working, but my question is still there as *.xyz.com is hosted on internet so how can firewall allowing  xyz.com fqdn to access ports on Lan zone through Custom URL category?. So here URL category is acting as source IP . So is it possible that custom url category can act as source or destination IP.   Thanks Dhananjay Bhakte ... View more

HI Alexzandar,   Traffic is not URL traffic and its application is not applicable.  For known fqdn e.g abc.xyz.com it is possible to write rule however fqdn is not fixed, customer says fqdn will change every time but domain (xyz.com) would be fixed, So my query is Can I allow wildcast *.xyz.com instead of single fqdn in security policy using custom url category for custom ports.?   Thanks Dhananjay Bhakte     ... View more

HI Rene,   I have requirement from customer to open port 389 and 4172 for eg *.xyz domain. So I created custom category *.xyz.com and have to create rule by calling this category into rule and will allow only 389 and 4172 ports. As far my understanding url category work only for ssl and web-browsing traffic, so just wanted to know if I keep url category in rule for port port 389 and 4172 will that rule work?   Thanks Dhananjay ... View more

Thank You All for your help!   After enabling NAT traversal on PA firewall, Issue got resolved. Now I am able to ping IBM VPC machines from on-prem machine   Thanks  Dhananjay Bhakte ... View more

Hi MP,   I do not need to configure NAT because  I have IBM local subnet available for routing.   I have checked so far on Palo alto  =>>   1) Tunnel is UP 2)Traffic egress from proper tunnel interface 3)Bytes are sent but not received. 4)Proxy ID is configured since IBM cloud is policy based. 5)Security policies are in placed and traffic passing from correct policy but no return traffic.   I suspect issue from IBM cloud side. I did following on IBM side   1) Created VPC 2) Created VPN gateway 3) Allowed all traffic in security group and ACL   however I am non getting option for adding route. As you mentioned you, configured ipsec tunnel on IBM cloud , can you provide KB article link to configure ipsec tunnel.    Thanks Dhananjay Bhakte ... View more

HI Alexander,   Thank you for replying!   I agree that there is no need of created two policies for one side initiator but In my case both side are initiator. Hence I created two policies.   I checked both phases are UP and can see encrypted traffic in tunnel only from palo side there is no return traffic from IBM end.   As I mentioned on my first comment, I suspect issue from IBM end I will check it again.   @MP18    Could you please help how to setup routing and natting on IBM vpn , In IBM VPN its not letting me to add custom route towards vpn gateway.   Thanks Dhananjay Bhakte  ... View more