We recently purchase pa3020s for mainly application control reason and put them behind cisco ASAs. I set up trust-to -untrust policy which applies to outbound internet traffic. I denied unwanted apps and allowed rest using user group mapping. that is all working fine and users can access internet with no problem.. well, last week, I tried to do the same to default untrust-to-trust policy to the Inbound traffic. I created a policy that allowed the DMZ and remote VPN traffic coming through the ASA and I changed the default untrust -to-trust policy from allow to deny. The result was internet access stopped. No one could access Internet and I had to back the change out. My thinking was that this a state full firewall and for any outbound traffic, the return traffic should pass through if it matches a established session. is this not right with PA firewall? do they do statefull inspection or not? thank you
... View more
