0

I am testing a simple dynamic address group (DAG) based on policy tag matching...but the when I add the DAG to the policy all traffic stops and no IPs ever populate the DAG. I verified the LFP matches the desired IPs in the traffic logs so its not a matter of the IPs not existing in the logs.

Tag: "Static Addresses"
DAG: Name: Internal Static Addr
     Match: "Static Addresses"
LFP: Name Internal Address Detection
        Rule1: Name: Static
               Type: traffic
               Filter: (addr.src in 192.168.4.0/26)
               Action: "static", target: 'source address', timeout: 0, Tags: 'Static Addresses'
Security Rule:
     SZone: Trust
     Source: "Internal Static Addr"
     DZone: Untrust
     Destination: Any
     Application: Any
     Service: application-default
     Actions: LFP: "Internal Address Detection"

While enabled, all traffic stops for the internal IPs and the DAG never populates with any of my internal IPs. When I remove the DAG from the Rule and set source back to "any" my traffic works again.

What am I doing wrong?

Improve this question
1
  • I'm not that sharp wtih Palo Alto, so I could be misunderstanding this. But it looks like you have a Chicken-and-Egg problem. Your DAG must be populated by something (like User-ID agent, VMware Service Manager, XML API, etc), but perhaps you are attempting to populate the DAG with a Log Profile. In this case, the IP address is not in the DAG in order to get tagged by the LFP in order to get put into the DAG. When you use a Log Profile for tagging, isn't that normally used to detect malicious IPs so that a security rule can begin denying them?
    – user3629081
    Commented Mar 14 at 13:34

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.