About Jedi_D

Hello Folks, I'm trying to set up my Palo Alto to do Policy Based Forwarding.    Does PA do NAT before Policy Based Forwarding???   I've created Policy based forwarding to send traffic to an interface, if it is sourced from an address. 10.0.0.0/24  BUT it's seems to be failing ... sometimes. I've noticed that it fails when the source traffic is NATTED first.  So there is a NAT that changes the source address from 10.0.0.0/24 to 20.0.0.0/24 The PA doesn't do the Policy Based Forwarding, because it doesn't see the traffic come from 10.0.0.0/24 as it is natted.    Does that mean that the NAT is done before the Policy Based Forwarding? I guess it is? If I only want traffic to be policy forwarded if sourced from 10.1.0.0/16. So would my work around be to create a NAT policy, and if it matches 10.1.0.0/16 then do not NAT?  That way it will then keep the source address and be policy forwarded instead?   Any thoughts would be appreciated?     ... View more

Hello folks,  This might be a newbie type of question so I appreciate your patience.....   I need to create a site to site VPN using a self signed certificate. I'm happy to do the site to site VPN. But ........... I'm not sure how to use self signed certs for doing this. Does anyone have any procedure of how to do this using certificates? Are there any links that would help me get started? I've only found this for pan-os 6 but I'm using pan-os 8 https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClJdCAK   Do I need to create a Self-Signed Root CA Certificate first ?? before I generate a certificate?   Any help appreciated! Thank you.    Rgds Dinesh ... View more

Hello Folks,    I need some advice ....   I want to create a NAT rule to allow traffic to NOT be NATTED if it is going to a particular website.  e.g. if going to www.paloaltonetworks.com then dont NAT.   Is it possible to use URL objects for in a NAT policy??   Please could someone suggest how this can be done, or send me some useful links for doing this?   Thanks ... View more

Hello folks,   I want to use a wildcard for a FQDN, e.g.    *.paloaltonetworks.com     I want to use this as an object with a FQDN for the destination.    I read in the following article I need to create a custom URL category, and use that in the "service/URL category" as part of the security policy. I was hoping to use this as a destination IP address but it looks like you cant do that, as you need to specify the FQDN as a URL catergory. My question is, what do I use for the destination IP address in the securty policy??? I am guessing it would be any IP adresses, and the limiting factor will be the URL category.    https://live.paloaltonetworks.com/t5/Featured-Articles/DotW-FQDN-Policy/ta-p/65110   Any help appreciated.... we live in a complicated world!    thanks D ... View more

Hi people,    I want to troubleshoot a connectvity issue.... typical problem where server guy says "it's a firewall issue". Can anyone suggest what's the best way to allow all traffic? I was thinking of traffic from my source (10.0.0.0/8) to destination B10.1.0.0/8) but use  Application: ANY Service: ANY log both start and stop turn off virus checking,  turn off anti spoofing.    I want to avoid any issues with application ports and service types. Is service any, application any the best way to make the policy to allow all traffic? Or should i consider specifying application unknown-tcp and unknown-udp with service any or application default?   Any suggestions would help. thank you. D     ... View more

Hello friends,    I have a question about saving my firewall changes and then applying them at a later date. What I want to do, is enter all my changes into a production firewall, but then not commit them. I want to save just my changes, ie a small configlet. And then at a later date, "load" my changes and commit them (during out of production hours). I know this can be done, but not sure what the best methods is.    Should I use "load" configurations or "revert" configs.   I dont want to commit my changes into production by accident........... so any advice would be appreciated on the best method.   Thanks. ... View more

Dear Friends,  I'd be grateful if you could help me with this ...   I'd like to allow GRE traffic (protocol 47) through my Palo Alto FW. I want to allow all the GRE traffic through and not terminate a GRE tunnel on the PA itself. Appologies if this is simple, please can someone point out how I can do this? Do I need to create a FW policy to allow GRE protocol 47? Any suggestions or any documents references would be much appreicated.   DP ... View more